# systemd unit for nebula
# typically part of the package in Rocky Linux and Fedora, but for non-pkg
# installs, we want to keep the config consistent.

[Unit]
Description=Nebula overlay networking tool

After=basic.target network.target network-online.target
Before=sshd.service
Wants=basic.target network-online.target nss-lookup.target time-sync.target

[Service]
ExecReload=/bin/kill -HUP $MAINPID
ExecStart={{ nebula_bin_dir }}/nebula -config {{ nebula_config_dir }}/config.yml
SyslogIdentifier=nebula
#CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SETPCAP CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
CapabilityBoundingSet=CAP_NET_ADMIN
RestrictNamespaces=yes
WorkingDirectory={{ nebula_config_dir }}
ProtectClock=true
ProtectSystem=strict
ProtectHostname=yes
ProtectHome=yes
PrivateHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
NoNewPrivileges=yes
PrivateTmp=yes
UMask=0077
RestrictAddressFamilies=AF_NETLINK AF_INET AF_INET6
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
PrivateTmp=true
ProtectSystem=true
ProtectHome=true

[Install]
WantedBy=multi-user.target