[Unit]
Description=Blacktip: edge for tunnelled ports and websites
Documentation=https://git.veillax.com/Veillax/blacktip
After=network-online.target
Wants=network-online.target

[Service]
User=blacktip
Group=blacktip
# The Traefik that ships with Blacktip; set BLACKTIP_TRAEFIK= (empty) in the env file for the built-in proxy.
Environment=BLACKTIP_TRAEFIK=/usr/local/lib/blacktip/traefik
EnvironmentFile=-/etc/blacktip/blacktip.env
ExecStart=/usr/local/bin/blacktip -data /var/lib/blacktip
WorkingDirectory=/var/lib/blacktip
Restart=on-failure
RestartSec=3
# A port range can open up to 1000 listeners at once.
LimitNOFILE=65536

# Ports 80 and 443 need this; nothing else is granted.
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/var/lib/blacktip
ProtectHome=true
PrivateTmp=true
ProtectKernelTunables=true
ProtectControlGroups=true

# To list this machine's Docker containers (BLACKTIP_DOCKER=1), let the service read
# the Docker socket:   sudo usermod -aG docker blacktip   then restart it.

[Install]
WantedBy=multi-user.target