[Unit]
Description=Scert SSL 证书管理核心服务
Documentation=file:///scert/docs/Scert-service-management.md
After=network-online.target
Wants=network-online.target
Wants=Scert-storage.socket
After=Scert-storage.socket

[Service]
Type=notify
NotifyAccess=main
TimeoutStartSec=90
User=Scert
Group=Scert
WorkingDirectory=/scert
ExecStart=/scert/scert --config /scert/conf/scert.json serve
Environment=SCERT_BOOTSTRAP_FIREWALL_MODE=external
Environment=SCERT_SERVER_HOST=127.0.0.1
KillSignal=SIGTERM
# 为任务取消、部署回滚及持久化收尾预留时间，超过预算仍由启动恢复处理。
TimeoutStopSec=180
Restart=on-failure
UMask=0077
RuntimeDirectory=scert
RuntimeDirectoryMode=0700
NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=
PrivateTmp=yes
PrivateDevices=yes
ProtectHome=yes
ProtectSystem=strict
ProtectHostname=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
ProtectKernelLogs=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
SystemCallArchitectures=native
ReadWritePaths=/scert/conf /scert/data /scert/log /scert/backups
# 初始化临时证书读取本机网卡地址需要 NETLINK_ROUTE，不授予网络管理能力。
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK

[Install]
WantedBy=multi-user.target