website-feeds

 1[Unit]
 2Description=Website Feeds
 3After=network.target postgresql.service
 4
 5[Service]
 6Type=simple
 7DynamicUser=true
 8ExecStart=/usr/local/bin/website-feeds
 9EnvironmentFile=/etc/website-feeds/config.env
10WorkingDirectory=/tmp
11Restart=always
12
13# Hardening options:
14CapabilityBoundingSet=
15DevicePolicy=closed
16LockPersonality=true
17MemoryDenyWriteExecute=true
18NoNewPrivileges=true
19PrivateDevices=true
20PrivateTmp=true
21PrivateUsers=true
22ProcSubset=pid
23ProtectClock=true
24ProtectControlGroups=true
25ProtectHome=true
26ProtectHostname=true
27ProtectKernelLogs=true
28ProtectKernelModules=true
29ProtectKernelTunables=true
30ProtectSystem=strict
31RestrictAddressFamilies=AF_INET AF_INET6
32RestrictNamespaces=true
33RestrictRealtime=true
34SystemCallArchitectures=native
35SystemCallFilter=@system-service
36SystemCallFilter=~@privileged @resources
37SystemCallFilter=setrlimit
38
39[Install]
40WantedBy=multi-user.target