runciv.service

[Unit]
Description=A rust server for unciv
After=network.target

Wants=postgresql.service
After=postgresql.service

[Service]
Type=simple

User=runciv
Group=runciv

RuntimeDirectory=runciv
LogsDirectory=runciv
StateDirectory=runciv
ConfigurationDirectory=runciv

MemoryDenyWriteExecute=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictRealtime=yes
RestrictNamespaces=~user
InaccessiblePaths=/boot
PrivateUsers=yes
UMask=0177
PrivateDevices=yes
CapabilityBoundingSet=
ProtectClock=yes
SystemCallFilter=@system-service
ProtectHome=yes
PrivateTmp=yes
RestrictSUIDSGID=yes
NoNewPrivileges=yes
LockPersonality=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=noaccess
ProtectSystem=yes
ProtectHostname=yes
RemoveIPC=yes
ProtectControlGroups=yes
SystemCallArchitectures=native

WorkingDirectory=/var/lib/runciv/
ExecStart=/usr/local/bin/runciv start

Restart=always
RestartSec=3
TimeoutStopSec=3

[Install]
WantedBy=multi-user.target