[Unit]
Description=LogWisp log transport
Documentation=man:lw(1) https://github.com/lixenwraith/logwisp
Wants=network-online.target
After=network-online.target
# A broken configuration stops after five tries instead of looping forever.
StartLimitIntervalSec=60
StartLimitBurst=5

[Service]
Type=exec
User=logwisp
Group=logwisp
ExecStart=@BINDIR@/lw -c @SYSCONFDIR@/logwisp/logwisp.toml
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=5s
TimeoutStopSec=15s

# logwisp.tmpfiles creates both directories. A file sink elsewhere needs a
# drop-in with ReadWritePaths=, a source under /home one with ProtectHome=read-only,
# and a port below 1024 CapabilityBoundingSet= and AmbientCapabilities= both
# set to CAP_NET_BIND_SERVICE.
WorkingDirectory=/var/lib/logwisp
ReadWritePaths=/var/lib/logwisp /var/log/logwisp
UMask=0027

NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=
PrivateDevices=yes
PrivateTmp=yes
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProcSubset=pid
ProtectSystem=strict
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
LockPersonality=yes
MemoryDenyWriteExecute=yes

[Install]
WantedBy=multi-user.target