[Unit]
Description=Apache with PHP 7.4
After=network.target local-fs.target remote-fs.target nss-lookup.target
PartOf=chr-httpd74.target

[Service]
Type=simple
RootDirectory=/chroot/httpd74
RootDirectoryStartOnly=no

Environment=APACHE_STARTED_BY_SYSTEMD=true

Environment=APACHE_RUN_USER=www-data
Environment=APACHE_RUN_GROUP=www-data
Environment=APACHE_PID_FILE=/run/apache2/apache2.pid
Environment=APACHE_RUN_DIR=/run/apache2
Environment=APACHE_LOCK_DIR=/run/lock/apache2
Environment=APACHE_LOG_DIR=/var/log/apache2
Environment=LANG=C
Environment=LANGUAGE=C
Environment=LC_ALL=C

ExecStartPre=/usr/bin/install -d -o www-data -g www-data -m 0755 /run/lock/apache2
ExecStartPre=/usr/sbin/apache2-74 -t

ExecStart=/usr/sbin/apache2-74 -DFOREGROUND
ExecReload=/usr/sbin/apache2-74 -k graceful
ExecStop=/usr/sbin/apache2-74 -k stop

Restart=on-abort

UMask=002

PrivateTmp=true
MountAPIVFS=true
NoNewPrivileges=true
PrivateDevices=true
DevicePolicy=closed
ProtectSystem=full
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectProc=invisible
ProcSubset=pid
ProtectControlGroups=true
ProtectClock=true
ProtectHome=true
#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
#CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH
#RestrictNamespaces=uts ipc pid user cgroup
#RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
#MemoryDenyWriteExecute=yes
#LockPersonality=yes
#ReadOnlyPaths=/bin /sbin /lib /lib64 /usr /boot /etc
ReadOnlyPaths=/chroot/httpd74
ReadWritePaths=/chroot/httpd74/web
ReadWritePaths=/chroot/httpd74/var/log/apache2
ReadWritePaths=/chroot/httpd74/run
InaccessiblePaths=/chroot/httpd74/boot /chroot/httpd74/sys /chroot/httpd74/proc

# run
BindPaths=/chroot/httpd74/run:/run:norbind
# log, systemd notify
BindPaths=/run/systemd/notify:/run/systemd/notify:norbind /run/systemd/journal/dev-log:/run/systemd/journal/dev-log:norbind
# mysql
BindPaths=-/run/mysqld:/run/mysqld:norbind
# geoip
BindPaths=-/usr/share/GeoIP:/usr/share/GeoIP:norbind

# web
BindPaths=-/srv/web:/web:norbind
BindPaths=-/srv/webtmp:/web/temp:norbind

BindPaths=-/srv/log/apache2-74:/var/log/apache2:norbind

[Install]
#WantedBy=multi-user.target
WantedBy=chr-httpd74.target