[Unit]
Description=MetaCrate OpenSim grid agent
Documentation=https://git.rfc1437.de/hugo/MetaCrate
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=metacrate-agent
Group=metacrate-agent
EnvironmentFile=-/etc/metacrate/grid-agent.env
ExecStartPre=/usr/local/bin/metacrate-grid-agent --config /etc/metacrate/grid-agent.json --check-config
ExecStart=/usr/local/bin/metacrate-grid-agent --config /etc/metacrate/grid-agent.json
KillSignal=SIGINT
TimeoutStopSec=30s
Restart=on-failure
RestartSec=5s
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=strict
ReadOnlyPaths=/etc/metacrate
ReadWritePaths=/var/lib/metacrate/grid-agent
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=true
RestrictRealtime=true
SystemCallArchitectures=native
UMask=0077

[Install]
WantedBy=multi-user.target