[Unit]
Description=newsfeed content-sourcing worker (RSS/Atom polling + rescoring)
Documentation=https://git.lair.cafe/grenade/newsfeed
After=network-online.target newsfeed-api.service
Wants=network-online.target

[Service]
Type=exec
User=newsfeed
Group=newsfeed
ExecStart=/usr/local/bin/newsfeed-worker --config /etc/newsfeed/worker.toml
Restart=on-failure
RestartSec=5

# Hardening (architecture generic.md §8).
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
SystemCallArchitectures=native

# Same database file as the api (co-located: SQLite is single-host).
ReadWritePaths=/var/lib/newsfeed

RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6

[Install]
WantedBy=multi-user.target