# Copyright (c) 2026 Nikolay Govorov
# SPDX-License-Identifier: AGPL-3.0-or-later

[Unit]
Description=Mirum daemon (modern CI platform)
Requires=network-online.target
After=time-sync.target network-online.target remote-fs.target nss-lookup.target
Wants=time-sync.target

[Service]
Type=notify
User=mirumd
Group=mirumd
Restart=always
RestartSec=30
WatchdogSec=30
NotifyAccess=main
ExecPaths=/usr/local/bin/mirumd /usr/lib
ExecStart=/usr/local/bin/mirumd --config=/etc/mirum/mirumd.yaml
LimitCORE=infinity
LimitNOFILE=500000
AmbientCapabilities=CAP_NET_BIND_SERVICE

# %p is resolved to the systemd unit name
LogsDirectory=%p
StateDirectory=%p
CacheDirectory=%p
RuntimeDirectory=%p

UMask=0077
LockPersonality=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=true
ProcSubset=pid
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=strict
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictSUIDSGID=yes

[Install]
# service should not start from the rescue shell (rescue.target).
WantedBy=multi-user.target
