[Unit]
Description=DECNET Syslog-over-TLS Listener (master, RFC 5425)
Documentation=https://git.resacachile.cl/anti/DECNET/wiki/Logging-and-Syslog
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User={{ user }}
Group={{ group }}
WorkingDirectory={{ install_dir }}
EnvironmentFile=-{{ install_dir }}/.env.local
# Binds 0.0.0.0:6514 so workers across the LAN can connect. 6514 is not a
# privileged port (≥1024), so no CAP_NET_BIND_SERVICE is required.
Environment=DECNET_SYSTEM_LOGS=/var/log/decnet/decnet.listener.log
ExecStart={{ venv_dir }}/bin/decnet listener \
    --host 0.0.0.0 --port 6514 \
    --ca-dir /etc/decnet/ca \
    --log-path /var/log/decnet/master.log \
    --json-path /var/log/decnet/master.json
StandardOutput=append:/var/log/decnet/decnet.listener.log
StandardError=append:/var/log/decnet/decnet.listener.log

# Pure TLS server; no privileged network operations.
CapabilityBoundingSet=
AmbientCapabilities=

# Security Hardening
NoNewPrivileges=yes
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
LockPersonality=yes
# Writes forensic .log + parsed .json sinks; CA bundle is read-only.
ReadWritePaths=/var/log/decnet
ReadOnlyPaths=/etc/decnet

Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
