[Unit]
Description=cprot-captcha backend server
After=network.target
PartOf=chr-proxyd.target
ConditionPathExists=/chroot/proxyd/etc/cprot-captcha2/config.json

[Service]
Type=simple
User=proxy
Group=proxy

RootDirectory=/chroot/proxyd
RootDirectoryStartOnly=no

ExecStart=/usr/sbin/cprot-captcha-server -config /etc/cprot-captcha2/config.json
Restart=on-failure
RestartSec=5

# No /proc, /sys or /run inside the chroot.
MountAPIVFS=no
# Minimal /dev (null, urandom, ...), no real devices.
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict
UMask=0077

# --- Privileges ---
NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictNamespaces=yes
RemoveIPC=yes

# --- Kernel ---
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes

#ProtectProc=invisible
#ProcSubset=pid

# --- Network: TCP to/from localhost only (nginx). Widen if nginx is remote. ---
RestrictAddressFamilies=AF_INET AF_INET6
IPAddressDeny=any
IPAddressAllow=localhost

# --- System calls ---
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged
SystemCallErrorNumber=EPERM

# --- Resources (100000 open challenges take about 150 MB) ---
MemoryMax=512M
TasksMax=256

ReadOnlyPaths=/bin /sbin /lib /lib64 /usr /boot /etc
ReadOnlyPaths=/chroot/proxyd
InaccessiblePaths=/chroot/proxyd/boot /chroot/proxyd/sys /chroot/proxyd/proc

# run
BindPaths=/chroot/proxyd/run:/run:norbind
# systemd notify, log
BindPaths=/run/systemd/notify:/run/systemd/notify:norbind /run/systemd/journal/dev-log:/run/systemd/journal/dev-log:norbind

[Install]
WantedBy=chr-proxyd.target