[Unit]
Description=QuickML Service (chroot)
After=network.target local-fs.target remote-fs.target nss-lookup.target
PartOf=chr-mlistd.target

[Service]
Type=simple
RootDirectory=/chroot/mlistd
RootDirectoryStartOnly=no

User=list
Group=list

WorkingDirectory=/var/lib/quickml
#RuntimeDirectory=quickml
ExecStartPre=/usr/bin/install -m 755 -o list -g list -d /run/quickml
ExecStart=/usr/sbin/quickml
#PIDFile=/run/quickml/quickml.pid
Restart=always
StandardOutput=journal
StandardError=journal
#SyslogIdentifier=1

#LimitMEMLOCK=infinity
#LimitNOFILE=65535

PrivateTmp=true
MountAPIVFS=true
NoNewPrivileges=true
PrivateDevices=true
DevicePolicy=closed
ProtectSystem=full
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectProc=invisible
ProcSubset=pid
ProtectControlGroups=true
ProtectClock=true
#ProtectHome=true
#RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
#CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH
#RestrictNamespaces=uts ipc pid user cgroup
#RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
#MemoryDenyWriteExecute=yes
#LockPersonality=yes
ReadOnlyPaths=/bin /sbin /lib /lib64 /usr /boot /etc
ReadOnlyPaths=/chroot/mlistd
ReadWritePaths=/chroot/mlistd/run
InaccessiblePaths=/chroot/mlistd/boot /chroot/mlistd/sys /chroot/mlistd/proc

# run
BindPaths=/chroot/mlistd/run:/run:norbind
# log, systemd notify
BindPaths=/run/systemd/notify:/run/systemd/notify:norbind /run/systemd/journal/dev-log:/run/systemd/journal/dev-log:norbind

# data
BindPaths=-/srv/quickml:/var/lib/quickml:norbind
# log
BindPaths=-/srv/log/quickml:/var/log/quickml:norbind


[Install]
#WantedBy=multi-user.target
WantedBy=chr-mlistd.target