# Housecarl: keeps the firewall's nftables ruleset; its REST API and web UI.
# Installed as /etc/systemd/system/housecarl.service (see docs/install.md).
[Unit]
Description=Housecarl firewall manager (with web UI and API)
Documentation=file:///usr/local/share/doc/housecarl/README.md
# The confirmed ruleset is already in force from housecarl-ruleset.service.
After=housecarl-ruleset.service network-online.target
Wants=network-online.target

[Service]
Type=notify
NotifyAccess=main
ExecStart=/usr/local/bin/housecarld --config /etc/housecarl/housecarl.yaml serve
# SIGHUP rereads the TLS certificate.
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=2s

User=housecarl
Group=housecarl
UMask=0027

# /var/lib/housecarl: the database and the confirmed ruleset (ruleset.nft).
StateDirectory=housecarl
StateDirectoryMode=0750
ConfigurationDirectory=housecarl
ConfigurationDirectoryMode=0750
# /run/housecarl: the local API socket (housecarl.sock), for root and the
# housecarl user.
RuntimeDirectory=housecarl
RuntimeDirectoryMode=0750

# Sandboxing: housecarld writes only its own state.
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
NoNewPrivileges=yes
# The only privilege housecarld gets: changing nftables (it runs nft) and
# reading logged packets (nfnetlink_log), both CAP_NET_ADMIN.
CapabilityBoundingSet=CAP_NET_ADMIN
AmbientCapabilities=CAP_NET_ADMIN
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
# AF_NETLINK: nftables, logged packets, the interfaces and their addresses.
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM

[Install]
WantedBy=multi-user.target
# 'systemctl restart housecarld' works too (the daemon's binary is housecarld).
Alias=housecarld.service