[Unit]
Description=odidere
After=network.target

[Service]
User=%i
ExecStart=/usr/local/bin/odidere -c /etc/odidere/config.yaml
Restart=on-failure

# Makes /usr, /boot, /efi, and /etc read-only for the service and its tools.
# ProtectSystem=full

# Gives the service and its tools private /tmp and /var/tmp directories.
# Files in those directories are not shared with other services.
# PrivateTmp=true

# These optional restrictions also apply to tool subprocesses.
# https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html

# Restricts system calls to the native architecture. Tools that execute
# binaries for another ABI, such as 32-bit binaries, can fail.
# SystemCallArchitectures=native

# Blocks writable executable memory. Tool runtimes that generate machine
# code can fail under this restriction.
# MemoryDenyWriteExecute=true

# Prevents privilege gains through setuid executables or file capabilities.
# Tools that rely on those privilege gains can fail.
# NoNewPrivileges=true

[Install]
WantedBy=multi-user.target