[Unit]
Description=RVBox server
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=rvbox
Group=rvbox
ExecStartPre=/usr/local/bin/rvbox-server --check-config --config /etc/rvbox/server.toml
ExecStart=/usr/local/bin/rvbox-server --config /etc/rvbox/server.toml
Restart=on-failure
RestartSec=5s
TimeoutStopSec=35s
WorkingDirectory=/var/lib/rvbox-server
StateDirectory=rvbox-server
RuntimeDirectory=rvbox
RuntimeDirectoryMode=0750
UMask=0077
LimitNOFILE=65536
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
ReadWritePaths=/var/lib/rvbox-server /run/rvbox

[Install]
WantedBy=multi-user.target