# Guard: watches logs and bans misbehaving addresses at the firewall
# (Housecarl's ban lists). Installed as /etc/systemd/system/guard.service
# (see docs/install.md).
[Unit]
Description=Guard: bans addresses that misbehave in the logs, at the firewall
Documentation=file:///usr/local/share/doc/guard/README.md
After=network-online.target
Wants=network-online.target

[Service]
ExecStart=/usr/local/bin/guard --config /etc/guard/guard.yaml run
Restart=on-failure
RestartSec=5s

User=guard
Group=guard
# Reading logs: /var/log's files (adm) and the journal (systemd-journal).
# On the firewall, add housecarl to use Housecarl's local socket.
SupplementaryGroups=adm systemd-journal
UMask=0027

# /var/lib/guard: the state (repeat offenders, bans waiting for
# Housecarl). /run/guard: the socket guard status asks.
StateDirectory=guard
StateDirectoryMode=0750
ConfigurationDirectory=guard
ConfigurationDirectoryMode=0750
RuntimeDirectory=guard
RuntimeDirectoryMode=0750

# Sandboxing: Guard only reads logs and talks to Housecarl.
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
NoNewPrivileges=yes
CapabilityBoundingSet=
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM

[Install]
WantedBy=multi-user.target