# job-search: serves the API and frontend, and runs the enabled sources'
# fetchers (job-search serve). See README.md, "Running as a service".
#
# Install, from the release tarball's directory (job-search-<version>-<arch>):
#   sudo useradd --system --home-dir /var/lib/job-search --shell /usr/sbin/nologin job-search
#   sudo install -m 755 job-search /usr/local/bin/job-search
#   sudo install -d -m 750 -o root -g job-search /etc/job-search
#   sudo install -m 640 -o root -g job-search config.yaml /etc/job-search/config.yaml
#   sudo install -d -m 750 -o job-search -g job-search /var/lib/job-search /var/log/job-search
#   sudo -u job-search /usr/local/bin/job-search --config /etc/job-search/config.yaml migrate up --create
#   sudo install -m 644 job-search.service /etc/systemd/system/
#   sudo systemctl daemon-reload
#   sudo systemctl enable --now job-search
#
# /etc/job-search/config.yaml should set the database:
#   database:
#       file: /var/lib/job-search/jobsearch.db
# Logs go to the journal (journalctl -u job-search), unless logging.file is
# set to log to a file instead, rotated with job-search.logrotate:
#   logging:
#       file: /var/log/job-search/job-search.log
#   sudo install -m 644 job-search.logrotate /etc/logrotate.d/job-search
#
# After each upgrade, migrate the database before restarting:
#   sudo -u job-search /usr/local/bin/job-search --config /etc/job-search/config.yaml migrate up
#   sudo systemctl restart job-search

[Unit]
Description=Job Search: procurement opportunities server and fetcher
Documentation=https://git.avsdev.uk/Go/job-search
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=job-search
Group=job-search
# /var/lib/job-search and /var/log/job-search, created and owned by the
# service user; the only places it can write.
StateDirectory=job-search
StateDirectoryMode=0750
LogsDirectory=job-search
LogsDirectoryMode=0750
WorkingDirectory=/var/lib/job-search
ExecStart=/usr/local/bin/job-search --config /etc/job-search/config.yaml serve
# serve shuts down cleanly on SIGTERM: the HTTP server drains and in-flight
# fetches get up to 10s.
KillSignal=SIGTERM
TimeoutStopSec=30
# A failing source stops serve on purpose; restart to retry it.
Restart=on-failure
RestartSec=30
UMask=0027

# Hardening
NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources

[Install]
WantedBy=multi-user.target