[Unit]
Description=Private Railiance application time authority
After=network.target railiance-clock-health.service
Requires=railiance-clock-health.service
[Service]
User=railiance-clock
Group=railiance-clock
ExecStart={{ railiance_clock_install_root }}/venv/bin/railiance-clock serve --config {{ railiance_clock_install_root }}/authority.json
NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6
IPAddressDeny=any
IPAddressAllow=localhost
MemoryMax=128M
TasksMax=32
UMask=0077
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target