[Unit]
Description=Kresus service
After=network.target

[Service]
User=kresus
Group=kresus
Type=simple
WorkingDirectory=~
Environment=NODE_ENV=production
ExecStart=/usr/bin/kresus -c /etc/webapps/kresus/config.ini
Restart=always
CapabilityBoundingSet=
NoNewPrivileges=true
PrivateUsers=true
PrivateDevices=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=strict
ProtectControlGroups=yes
ProtectKernelTunables=true
ProtectKernelModules=yes
ReadWritePaths=/etc/webapps/kresus/config.ini /var/lib/kresus
LockPersonality=true
#MemoryDenyWriteExecute=true
RestrictRealtime=true
SystemCallArchitectures=native
SystemCallFilter=@system-service

[Install]
WantedBy=multi-user.target
