[Unit]
Description=Scert Nginx 受限证书激活服务
Requires=scert-nginx.socket nginx.service
PartOf=nginx.service
After=scert-nginx.socket nginx.service
ConditionPathExists=/etc/scert-nginx/policy.json

[Service]
Type=simple
User=root
Group=root
ExecStart=/usr/local/libexec/scert-nginx --policy /etc/scert-nginx/policy.json
UMask=0077
TimeoutStopSec=40
Restart=on-failure
RestartSec=5
NoNewPrivileges=yes
CapabilityBoundingSet=CAP_DAC_OVERRIDE CAP_CHOWN CAP_NET_BIND_SERVICE
AmbientCapabilities=
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ProtectHostname=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
# Nginx 配置检查会打开日志和 PID；非标准部署须按实际路径单独评审。
ReadWritePaths=/var/lib/scert-nginx -/var/log/nginx -/var/lib/nginx -/var/cache/nginx -/run/nginx.pid