ip-please.service

# Example systemd service file for ip-please
#
# Note that is an example, you will probably need to edit this before you use
# it in a production environment.

[Unit]
Description=gunicorn instance for ip-please
After=network.target

[Service]
#User=nobody
WorkingDirectory=/opt/ip-please/src
Environment="PATH=/opt/ip-please/ip-pleasevenv/bin"
ExecStart=/opt/ip-please/ip-pleasevenv/bin/gunicorn --workers 3 --bind 127.0.0.1:5000 wsgi:app
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s TERM $MAINPID

# Extra security hardening options

# Empty because ip-please does not require any special capability. See capabilities(7) for more information.
CapabilityBoundingSet=
DynamicUser=true
IPAddressAllow=127.0.0.0/8
IPAddressDeny=any # the allow-list is evaluated before the deny list. Since the default is to allow, we need to deny everything.
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
PrivateUsers=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=strict
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
UMask=077

[Install]
WantedBy=multi-user.target