[Unit]
Description=Hammerhead: control plane for tunnelled ports and websites
Documentation=https://git.veillax.com/Veillax/hammerhead
After=network-online.target
Wants=network-online.target

[Service]
User=hammerhead
Group=hammerhead
EnvironmentFile=-/etc/hammerhead/hammerhead.env
ExecStart=/usr/local/bin/hammerhead -listen :8080 -data /var/lib/hammerhead
WorkingDirectory=/var/lib/hammerhead
Restart=on-failure
RestartSec=3

# It only needs its own data folder and the network.
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/var/lib/hammerhead
ProtectHome=true
PrivateTmp=true
ProtectKernelTunables=true
ProtectControlGroups=true

[Install]
WantedBy=multi-user.target