[Unit]
Description=CMPP restricted security execution agent
After=network.target fail2ban.service nftables.service

[Service]
Type=simple
User=root
Group=cmpp-security
EnvironmentFile=/etc/cmpp-platform/cmpp-platform.env
ExecStart=/opt/cmpp-platform/current/bin/cmpp-security-agent
Restart=on-failure
RestartSec=3
NoNewPrivileges=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=strict
ReadWritePaths=/run/cmpp-security-agent /var/lib/cmpp-security-agent /etc/nginx/snippets /etc/fail2ban/jail.d
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_KILL
AmbientCapabilities=CAP_NET_ADMIN CAP_DAC_OVERRIDE
LockPersonality=true
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target