# The Kokkoja relay as a system service.  Installed by deploy/setup_vps.sh
# as /etc/systemd/system/kokkoja-relay.service.
#
# The relay listens on this computer only; nginx terminates TLS and
# forwards wss://<site>/relay/... to it (deploy/nginx-site.conf).

[Unit]
Description=Kokkoja relay
After=network.target

[Service]
User=kokkoja
Group=kokkoja
ExecStart=/opt/kokkoja/venv/bin/python /opt/kokkoja/relay/kokkoja_relay.py --host 127.0.0.1 --port 8770
Restart=on-failure
RestartSec=5
# The relay needs nothing on the system but its own code.
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6
MemoryDenyWriteExecute=yes

[Install]
WantedBy=multi-user.target