[Unit]
Description=sl-map-web (Second Life map web UI)
Documentation=https://github.com/taladar/sl-map-tools
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=sl-map-web
Group=sl-map-web
EnvironmentFile=/etc/sl-map-web/sl-map-web.env
ExecStart=/usr/local/bin/sl_map_web
Restart=on-failure
RestartSec=5s

StateDirectory=sl-map-web
StateDirectoryMode=0750
WorkingDirectory=/var/lib/sl-map-web

NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectClock=true
ProtectHostname=true
ProtectProc=invisible
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
CapabilityBoundingSet=
AmbientCapabilities=
RemoveIPC=true
UMask=0027
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
ReadWritePaths=/var/lib/sl-map-web

[Install]
WantedBy=multi-user.target
