[Unit]
Description=tPSGI for __DOMAIN__
Wants=multi-user.target
After=multi-user.target

[Install]
WantedBy=multi-user.target

[Service]
Type=forking
PIDFile=__REPLACEME__/run/tpsgi.pid
Environment=PATH='__PERL5BIN__' HOME=__REPLACEME__/
ExecStart=__REPLACEME__/service/tpsgi.sh

# The key an application uses to seal whatever it keeps for its users, which has
# no business living next to what it protects.  bin/build_service puts it in
# /etc/credstore.encrypted, and systemd decrypts it into a ramdisk under
# /run/credentials that only this service can read.
#
# Not fatal when there is nothing there, which is the point of ImportCredential
# over LoadCredential: an installation with no secrets to hand over is an
# installation that starts normally.
#
# The workers end up chrooted into WorkingDirectory and /run/credentials is
# outside it, so service/tpsgi.sh reads what it needs before that happens.
ImportCredential=tpsgi-vault
WorkingDirectory=__REPLACEME__/
Restart=always
OOMPolicy=stop
ExecReload=kill -HUP $MAINPID
AmbientCapabilities=CAP_SYS_RESOURCE CAP_SYS_NICE
LockPersonality=yes
MemoryDenyWriteExecute=yes
OOMPolicy=continue
PrivateDevices=yes
PrivateTmp=true
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=read-only
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectSystem=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
NoNewPrivileges=yes