[Unit]
Description=tPSGI for __DOMAIN__
Wants=multi-user.target
After=multi-user.target

[Install]
WantedBy=multi-user.target

[Service]
Type=forking
PIDFile=__REPLACEME__/run/tpsgi.pid
Environment=PATH='__PERL5BIN__' HOME=__REPLACEME__/
ExecStart=__REPLACEME__/service/tpsgi.sh
WorkingDirectory=__REPLACEME__/
Restart=always
OOMPolicy=stop
ExecReload=kill -HUP $MAINPID
AmbientCapabilities=CAP_SYS_RESOURCE CAP_SYS_NICE
LockPersonality=yes
MemoryDenyWriteExecute=yes
OOMPolicy=continue
PrivateDevices=yes
PrivateTmp=true
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=read-only
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectSystem=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes