# Jarl daemon: web UI and REST API for managing BIND.
# Installed as /etc/systemd/system/jarl.service (see docs/install.md).
[Unit]
Description=Jarl BIND manager (web UI and API)
Documentation=file:///usr/local/share/doc/jarl/README.md
After=network-online.target named.service
Wants=network-online.target

[Service]
Type=notify
NotifyAccess=main
ExecStart=/usr/local/bin/jarld --config /etc/jarl/jarl.yaml serve
# SIGHUP rereads the TLS certificate.
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=5s

User=jarl
Group=jarl
# Membership of 'bind' lets jarld read /etc/bind/rndc.key and the rest of
# named's configuration (for rndc and named-checkconf) and give generated
# files to group bind so named can read them.
SupplementaryGroups=bind
UMask=0027

# /var/lib/jarl: database and staging area.
StateDirectory=jarl
StateDirectoryMode=0750
ConfigurationDirectory=jarl
ConfigurationDirectoryMode=0750
# /run/jarl: the local API socket (jarl.sock), for root and the jarl user.
RuntimeDirectory=jarl
RuntimeDirectoryMode=0750

# Sandboxing. jarld may only write its own state and the directories it
# manages for named (created by tmpfiles.d/jarl.conf).
ProtectSystem=strict
ReadWritePaths=/etc/bind/jarl /var/lib/bind/jarl /var/cache/bind/jarl
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
# @system-service includes @chown, which jarld needs to give files to group bind.
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM

[Install]
WantedBy=multi-user.target