[Unit]
Description=Vacuum Wall Daemon (privileged backend)
Documentation=https://github.com/wall/vacuum-wall
After=network.target firewalld.service
Wants=firewalld.service

[Service]
Type=simple
User={{ USER_DAEMON_NAME }}
Group={{ USER_GROUP }}
WorkingDirectory={{ PROJECT_DIR }}
ExecStart={{ PROJECT_DIR }}/.venv/bin/python -m daemon
Restart=on-failure
RestartSec=5
TimeoutStopSec=15
Environment=PATH=/usr/local/bin:/usr/bin
Environment=PYTHONUNBUFFERED=1
Environment=ACME_HOME={{ PROJECT_DIR }}/data/acme
Environment=HOME={{ PROJECT_DIR }}

# Runtime directory for temp files used during config apply
RuntimeDirectory=vacuum-wall
RuntimeDirectoryMode=0750

LogsDirectory=vacuum-wall

# Security hardening
ProtectSystem=strict
ReadWritePaths={{ PROJECT_DIR }} /tmp /etc/systemd/network /etc/nginx /etc/dnsmasq.d /etc/wireguard /run/vacuum-wall /run/sudo /run/firewalld /run/nginx /run/nginx.pid /var/log/nginx /var/log/vacuum-wall
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
ProtectHostname=yes
RestrictSUIDSGID=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictNamespaces=yes
LockPersonality=yes
SystemCallFilter=@system-service
PrivateDevices=yes

RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
IPAddressDeny=any
IPAddressAllow=localhost
NoNewPrivileges=yes

[Install]
WantedBy=multi-user.target