# systemd unit for RustForge. Install to /etc/systemd/system/rustforge.service, then:
#   sudo systemctl daemon-reload && sudo systemctl enable --now rustforge
[Unit]
Description=RustForge - read-only cgit-style git web host
Documentation=file:///opt/rustforge/README.md
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=rustforge
Group=rustforge
ExecStart=/opt/rustforge/bin/rustforge /etc/rustforge/rustforge.toml
WorkingDirectory=/srv/git
Environment=HOME=/srv/git
Restart=on-failure
RestartSec=2s

# --- hardening -------------------------------------------------------------
# RustForge only *reads* repos (git upload-pack never writes), so the whole
# filesystem is read-only to it; /tmp is a private, empty tmpfs.
NoNewPrivileges=true
ProtectSystem=strict
ReadOnlyPaths=/srv/git /etc/rustforge /opt/rustforge
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectClock=true
ProtectHostname=true
RestrictSUIDSGID=true
RestrictRealtime=true
RestrictNamespaces=true
LockPersonality=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
CapabilityBoundingSet=
AmbientCapabilities=
UMask=0077

[Install]
WantedBy=multi-user.target