[Unit]
Description=JWeBot isolated extension host for %i
After=local-fs.target
Requires=jwebot-extension-host@%i.socket
ConditionPathExists=/etc/jwebot-extension-host/allowed_signers

[Service]
Type=exec
User=jwebot-ext
Group=jwebot-ext
Environment=PYTHONDONTWRITEBYTECODE=1
ExecStart=/opt/jwebot-extension-host/venv/bin/python -I -m jwebot_extension_host --release-dir /var/lib/jwebot-extensions/%i/current --allowed-signers /etc/jwebot-extension-host/allowed_signers
WorkingDirectory=/
StandardInput=socket
StandardOutput=socket
StandardError=journal
Restart=no
TimeoutStartSec=12s
RuntimeMaxSec=12s
UMask=0077

NoNewPrivileges=true
CapabilityBoundingSet=
AmbientCapabilities=
PrivateTmp=true
PrivateDevices=true
PrivateNetwork=true
ProtectSystem=strict
ProtectHome=true
ProtectClock=true
ProtectControlGroups=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProcSubset=pid
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictRealtime=true
RestrictSUIDSGID=true
RestrictAddressFamilies=AF_UNIX
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@clock @debug @module @mount @obsolete @privileged @raw-io @reboot @swap

MemoryMax=128M
CPUQuota=50%
TasksMax=16
LimitNOFILE=64
LimitNPROC=16
LimitCORE=0

ReadOnlyPaths=/var/lib/jwebot-extensions/%i
InaccessiblePaths=/home /root /srv /mnt /media