[Unit]
Description=Bootstrap OCI L4 relay
Wants=network-online.target
After=network-online.target nftables.service
ConditionPathExists=/etc/oci-l4-relay/config.json

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/oci-l4-relay-guest bootstrap
RemainAfterExit=true
LogNamespace=oci-l4-relay
CapabilityBoundingSet=CAP_NET_ADMIN
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectSystem=strict
ReadWritePaths=/etc/oci-l4-relay /etc/sysconfig /etc/sysctl.d /var/lib/oci-l4-relay
RestrictAddressFamilies=AF_UNIX AF_INET AF_NETLINK
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
Restart=on-failure
RestartSec=15
SystemCallArchitectures=native
SystemCallFilter=@system-service
UMask=0077

[Install]
WantedBy=multi-user.target