# Steward: the DHCP server, its REST API and web UI.
# Installed as /etc/systemd/system/steward.service (see docs/install.md).
[Unit]
Description=Steward DHCP server (with web UI and API)
Documentation=file:///usr/local/share/doc/steward/README.md
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
NotifyAccess=main
ExecStart=/usr/local/bin/stewardd --config /etc/steward/steward.yaml serve
# SIGHUP rereads the TLS certificate.
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=2s

User=steward
Group=steward
UMask=0027

# /var/lib/steward: the database (configuration and leases).
StateDirectory=steward
StateDirectoryMode=0750
ConfigurationDirectory=steward
ConfigurationDirectoryMode=0750
# /run/steward: the local API socket (steward.sock), for root and the
# steward user.
RuntimeDirectory=steward
RuntimeDirectoryMode=0750

# Sandboxing: stewardd writes only its own state.
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
NoNewPrivileges=yes
# The only privilege stewardd gets: listening on ports below 1024 (DHCP's
# port 67). Binding each socket to its interface (SO_BINDTODEVICE) and the
# ping check (an unprivileged ping socket) need nothing more.
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
# AF_NETLINK lets stewardd read the interfaces and their addresses.
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM

[Install]
WantedBy=multi-user.target
# 'systemctl restart stewardd' works too (the daemon's binary is stewardd).
Alias=stewardd.service