[Unit]
Description=newsfeed REST/JSON API
Documentation=https://git.lair.cafe/grenade/newsfeed
After=network-online.target
Wants=network-online.target

[Service]
# Type=exec (not notify): axum does not sd_notify READY=1, so notify would block until
# TimeoutStartSec. exec treats the unit as started once the binary execs successfully.
Type=exec
User=newsfeed
Group=newsfeed
ExecStart=/usr/local/bin/newsfeed-api --config /etc/newsfeed/config.toml
Restart=on-failure
RestartSec=2

# Hardening (architecture generic.md §8). Relax individually only if a feature needs it.
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
SystemCallArchitectures=native

# The SQLite database and WAL live here; shared read/write with newsfeed-worker.
ReadWritePaths=/var/lib/newsfeed

RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6

[Install]
WantedBy=multi-user.target