v0.22.0 several enhancements and fixes for security, network, doc, test, packaging

deploy/package/logwisp.service

@@ -0,0 +1,54 @@
+[Unit]
+Description=LogWisp log transport
+Documentation=man:lw(1) https://github.com/lixenwraith/logwisp
+Wants=network-online.target
+After=network-online.target
+# A broken configuration stops after five tries instead of looping forever.
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+Type=exec
+User=logwisp
+Group=logwisp
+ExecStart=@BINDIR@/lw -c @SYSCONFDIR@/logwisp/logwisp.toml
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+RestartSec=5s
+TimeoutStopSec=15s
+
+# logwisp.tmpfiles creates both directories. A file sink elsewhere needs a
+# drop-in with ReadWritePaths=, a source under /home one with ProtectHome=read-only,
+# and a port below 1024 CapabilityBoundingSet= and AmbientCapabilities= both
+# set to CAP_NET_BIND_SERVICE.
+WorkingDirectory=/var/lib/logwisp
+ReadWritePaths=/var/lib/logwisp /var/log/logwisp
+UMask=0027
+
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+PrivateDevices=yes
+PrivateTmp=yes
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProcSubset=pid
+ProtectSystem=strict
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RemoveIPC=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+
+[Install]
+WantedBy=multi-user.target