ce7cb702218693d08ea6d83464d2457c9250027c

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-smtp-evidence.service

@@ -0,0 +1,41 @@
+[Unit]
+Description=Collect OCI L4 relay transport evidence and metrics
+Wants=oci-l4-relay-telemetry.service
+After=nftables.service oci-l4-relay-bootstrap.service oci-l4-relay-telemetry.service
+ConditionPathExists=/etc/oci-l4-relay-smtp-evidence.json
+
+[Service]
+Type=simple
+DynamicUser=yes
+StateDirectory=oci-l4-relay/smtp-evidence
+ExecStart=/usr/local/libexec/oci-l4-relay-smtp-evidence
+Restart=on-failure
+RestartSec=10s
+LogNamespace=oci-l4-relay
+AmbientCapabilities=CAP_NET_ADMIN
+CapabilityBoundingSet=CAP_NET_ADMIN
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectProc=invisible
+ProtectSystem=strict
+ReadOnlyPaths=/etc/oci-l4-relay-smtp-evidence.json
+RestrictAddressFamilies=AF_INET AF_UNIX AF_NETLINK
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target