[Unit]
Description=Buffer OCI L4 relay journals for VictoriaLogs
Wants=network-online.target
After=network-online.target oci-l4-relay-bootstrap.service
ConditionPathExists=/etc/oci-l4-relay/log-ingest.token
PartOf=oci-l4-relay-logs.target

[Service]
Type=simple
User=oci-l4-relay-logs
Group=oci-l4-relay-logs
StateDirectory=oci-l4-relay-logs
ExecStart=/usr/local/bin/vlagent -httpListenAddr=127.0.0.1:19532 -journald.ignoreFields=__CURSOR,__MONOTONIC_TIMESTAMP,__SEQNUM,__SEQNUM_ID,_AUDIT_LOGINUID,_AUDIT_SESSION,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_MACHINE_ID,_PID,_RUNTIME_SCOPE,_SELINUX_CONTEXT,_SOURCE_REALTIME_TIMESTAMP,_SYSTEMD_CGROUP,_SYSTEMD_INVOCATION_ID,_SYSTEMD_SLICE,_SYSTEMD_USER_SLICE,_SYSTEMD_USER_UNIT,_TRANSPORT,_UID -journald.streamFields=_SYSTEMD_UNIT,_HOSTNAME -memory.allowedBytes=67108864 -remoteWrite.bearerTokenFile=/etc/oci-l4-relay/log-ingest.token -remoteWrite.maxDiskUsagePerURL=536870912 -remoteWrite.rateLimit=1048576 -remoteWrite.tmpDataPath=/var/lib/oci-l4-relay-logs -remoteWrite.url=https://relay-logs.quorate.dev/insert/native
Restart=on-failure
RestartSec=10s
Slice=oci-l4-relay-logs.slice
CapabilityBoundingSet=
IPAddressDeny=any
IPAddressAllow=localhost
IPAddressAllow=10.104.40.127
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=strict
ReadOnlyPaths=/etc/oci-l4-relay/log-ingest.token
ReadWritePaths=/var/lib/oci-l4-relay-logs
RestrictAddressFamilies=AF_UNIX AF_INET
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
UMask=0077