# Example hardened unit for a host that is not NixOS.
#
# Copy to /etc/systemd/system/metsuke.service, and bring:
#   the binary at /usr/local/bin/metsuke
#   the configuration at /etc/metsuke/config.toml
#   the signing key at /etc/metsuke/signing-key, owned by root, mode 0400
#
# Take https://metsuke-leios.play.dev.cardano.org/files/config.minimal.toml as the configuration. This unit
# collects metrics and reads no trace lines. For those,
# https://metsuke-leios.play.dev.cardano.org/files/metsuke-journald.service reads the node's journal and
# https://metsuke-leios.play.dev.cardano.org/files/node-pipe.conf reads its stdout; ADR 0010 has what each
# one costs.

[Unit]
Description=metsuke telemetry agent
After=network-online.target
Wants=network-online.target

[Service]
LoadCredential=signing-key:/etc/metsuke/signing-key
ExecStart=/usr/local/bin/metsuke --config /etc/metsuke/config.toml --signing-key %d/signing-key
Restart=always
RestartSec=30
AmbientCapabilities=
CapabilityBoundingSet=
DynamicUser=true
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
RestrictAddressFamilies=AF_INET
RestrictAddressFamilies=AF_INET6
RestrictAddressFamilies=AF_NETLINK
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
StateDirectory=metsuke
SupplementaryGroups=
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged
SystemCallFilter=~@resources
UMask=0077

[Install]
WantedBy=multi-user.target