[Unit]
Description=Guanghu Zhulan Restricted Remote Development Cell
After=network-online.target zhulan-validation-executor.service
Wants=network-online.target
Requires=zhulan-validation-executor.service

[Service]
Type=simple
User=zhulan-runtime
Group=zhulan-runtime
EnvironmentFile=/etc/guanghu/zhulan-remote-cell.env
ExecStart=/usr/bin/python3 /opt/guanghu/zhulan-remote-cell/runtime/zhulan_cell.py
Restart=on-failure
RestartSec=3
UMask=0077
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictNamespaces=user mnt pid net ipc uts
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
ReadOnlyPaths=/opt/guanghu/zhulan-remote-cell /etc/guanghu/zhulan-remote-cell.env /etc/guanghu/secrets/zhulan-remote-cell.secret
ReadWritePaths=/var/lib/guanghu/zhulan-remote-cell
ReadWritePaths=/srv/guanghu/zhulan-cell/workspaces
ReadWritePaths=/srv/guanghu/zhulan-cell/candidates
StateDirectory=guanghu/zhulan-remote-cell

[Install]
WantedBy=multi-user.target