[Unit]
Description=Forgejo Service (chroot)
After=network.target local-fs.target remote-fs.target nss-lookup.target mysql.service
PartOf=chr-git.target

[Service]
#Type=simple
Type=exec
RootDirectory=/chroot/git
RootDirectoryStartOnly=no

User=forgejo
Group=forgejo

#Environment=USER=forgejo HOME=/home/forgejo PORT=6000
WorkingDirectory=/var/lib/forgejo
ExecStart=/usr/bin/forgejo web --config /etc/forgejo/app.ini
#ExecStartPost=/bin/bash -c 'echo $MAINPID > /run/forgejo/forgejo.pid'
#PIDFile=/chroot/git/run/forgejo/forgejo.pid

StandardOutput=journal
StandardError=journal
SyslogIdentifier=forgejo

Restart=always
RestartSec=5
TimeoutStopSec=30

#LimitMEMLOCK=infinity
#LimitNOFILE=65535

UMask=0027

PrivateTmp=true
MountAPIVFS=true
NoNewPrivileges=true
PrivateDevices=true
DevicePolicy=closed
ProtectSystem=strict
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectProc=invisible
ProcSubset=pid
ProtectControlGroups=true
ProtectClock=true
ProtectHostname=true
ProtectHome=true
#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
#CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH
CapabilityBoundingSet=
AmbientCapabilities=
#RestrictNamespaces=uts ipc pid user cgroup
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
MemoryDenyWriteExecute=yes
LockPersonality=yes
#ReadOnlyPaths=/bin /sbin /lib /lib64 /usr /boot /etc
ReadOnlyPaths=/chroot/git
ReadWritePaths=/chroot/git/var/lib/forgejo
#ReadWritePaths=/chroot/git/home/forgejo
#ReadWritePaths=/chroot/git/opt/forgejo/data
ReadWritePaths=/chroot/git/var/log/forgejo
ReadWritePaths=/chroot/git/run
InaccessiblePaths=/chroot/git/boot /chroot/git/sys

SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
SystemCallArchitectures=native

# run
BindPaths=/chroot/git/run:/run:norbind
# log, systemd notify
BindPaths=/run/systemd/notify:/run/systemd/notify:norbind /run/systemd/journal/dev-log:/run/systemd/journal/dev-log:norbind
# mysql
BindPaths=-/run/mysqld:/run/mysqld:norbind
# geoip
BindPaths=-/usr/share/GeoIP:/usr/share/GeoIP:norbind

# web
BindPaths=/srv/forgejo:/var/lib/forgejo:norbind
BindPaths=/srv/log/forgejo:/var/log/forgejo:norbind


[Install]
#WantedBy=multi-user.target
WantedBy=chr-git.target