# systemd unit for forge. Install to /etc/systemd/system/forge.service, then:
#   sudo systemctl daemon-reload && sudo systemctl enable --now forge
[Unit]
Description=forge - read-only cgit-style git web host
Documentation=file:///opt/forge/README.md
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=forge
Group=forge
ExecStart=/opt/forge/bin/forge /etc/forge/forge.toml
WorkingDirectory=/srv/git
Environment=HOME=/srv/git
Restart=on-failure
RestartSec=2s

# --- hardening -------------------------------------------------------------
# forge only *reads* repos (git upload-pack never writes), so the whole
# filesystem is read-only to it; /tmp is a private, empty tmpfs.
NoNewPrivileges=true
ProtectSystem=strict
ReadOnlyPaths=/srv/git /etc/forge /opt/forge
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectClock=true
ProtectHostname=true
RestrictSUIDSGID=true
RestrictRealtime=true
RestrictNamespaces=true
LockPersonality=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
CapabilityBoundingSet=
AmbientCapabilities=
UMask=0077

[Install]
WantedBy=multi-user.target