[Unit]
Description=Upload OCI L4 relay journal namespace to vlagent
Requires=oci-l4-relay-vlagent.service
After=oci-l4-relay-vlagent.service systemd-journald@oci-l4-relay.service
ConditionPathExists=/etc/oci-l4-relay/log-ingest.token
PartOf=oci-l4-relay-logs.target

[Service]
Type=simple
DynamicUser=yes
User=systemd-journal-upload
SupplementaryGroups=systemd-journal
StateDirectory=systemd/journal-upload
ExecStart=/usr/lib/systemd/systemd-journal-upload --namespace=oci-l4-relay --url=http://127.0.0.1:19532/insert/journald --save-state --system --follow
Restart=on-failure
RestartSec=10s
RestartSteps=10
RestartMaxDelaySec=60
Slice=oci-l4-relay-logs.slice
WatchdogSec=3min
CapabilityBoundingSet=
IPAddressDeny=any
IPAddressAllow=localhost
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
ReadWritePaths=/var/lib/systemd/journal-upload
RestrictAddressFamilies=AF_UNIX AF_INET
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
UMask=0077
LimitNOFILE=524288