[Unit]
Description=Collect OCI L4 relay transport evidence and metrics
Wants=oci-l4-relay-telemetry.service
After=nftables.service oci-l4-relay-bootstrap.service oci-l4-relay-telemetry.service
ConditionPathExists=/etc/oci-l4-relay-smtp-evidence.json

[Service]
Type=simple
DynamicUser=yes
StateDirectory=oci-l4-relay/smtp-evidence
ExecStart=/usr/local/libexec/oci-l4-relay-smtp-evidence
Restart=on-failure
RestartSec=10s
LogNamespace=oci-l4-relay
AmbientCapabilities=CAP_NET_ADMIN
CapabilityBoundingSet=CAP_NET_ADMIN
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
ReadOnlyPaths=/etc/oci-l4-relay-smtp-evidence.json
RestrictAddressFamilies=AF_INET AF_UNIX AF_NETLINK
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
UMask=0077

[Install]
WantedBy=multi-user.target