[Unit]
Description=MoShiro agent (network line quality collector)
After=network-online.target
Wants=network-online.target

[Service]
Type=exec
User=moshiro
Group=moshiro
ExecStart=/usr/lib/moshiro/moshiro-agent --config /etc/moshiro/agent.json
Restart=always
RestartSec=5

# The agent is a pure collector: it reads its config and identity, never writes files, never starts processes.
ReadOnlyPaths=/etc/moshiro
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
LockPersonality=yes
# NativeAOT does not JIT, so writable+executable memory is never needed.
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
# CAP_NET_RAW only for ICMP target tasks. Ports below 1024 need CAP_NET_BIND_SERVICE (add it in a drop-in).
CapabilityBoundingSet=CAP_NET_RAW
AmbientCapabilities=CAP_NET_RAW

MemoryMax=128M
TasksMax=64
LimitNOFILE=4096

[Install]
WantedBy=multi-user.target