Add systemd service and installation workflow improvements

chronoseal.service

@@ -1,67 +1,36 @@
 [Unit]
-Description=ChronoSeal cryptographic browser attestation service
-Documentation=https://chronoseal.rs
-After=network-online.target
+Description=ChronoSeal Cryptographic Attestation Daemon
+After=network.target
 Wants=network-online.target
 
 [Service]
 Type=simple
-
 User=chronoseal
 Group=chronoseal
-
-Environment=RUST_LOG=info
-Environment=CHRONOSEAL_CONFIG=/etc/chronoseal/config.toml
-Environment=CHRONOSEAL_STATE_DIR=/var/lib/chronoseal
-Environment=CHRONOSEAL_PID_FILE=/run/chronoseal.pid
-
 ExecStart=/usr/local/bin/chronoseal run
-ExecStartPre=+/usr/bin/touch /run/chronoseal.pid
-ExecStartPre=+/usr/bin/chown chronoseal:chronoseal /run/chronoseal.pid
-ExecReload=/bin/kill -HUP $MAINPID
-ExecStopPost=+/usr/bin/rm -f /run/chronoseal.pid
-PIDFile=/run/chronoseal.pid
-
-Restart=on-failure
+WorkingDirectory=/opt/chronoseal
+Restart=always
 RestartSec=3
-TimeoutStopSec=30
-KillSignal=SIGTERM
+Environment=RUST_LOG=info
 
-RuntimeDirectory=chronoseal
-RuntimeDirectoryMode=0750
-StateDirectory=chronoseal
-StateDirectoryMode=0750
-LogsDirectory=chronoseal
-LogsDirectoryMode=0750
-ConfigurationDirectory=chronoseal
-ConfigurationDirectoryMode=0750
-
-NoNewPrivileges=true
-PrivateTmp=true
+# Hardening (production-grade)
 ProtectSystem=strict
-ProtectHome=read-only
-ProtectKernelTunables=true
-ProtectKernelModules=true
-ProtectControlGroups=true
-ProtectClock=true
-ProtectHostname=true
-ProtectProc=invisible
-ProcSubset=pid
-PrivateDevices=true
-PrivateIPC=true
-
-MemoryDenyWriteExecute=true
-RestrictRealtime=true
-RestrictSUIDSGID=true
-RemoveIPC=true
-
-LockPersonality=true
-
+ProtectHome=yes
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+MemoryDenyWriteExecute=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
 SystemCallArchitectures=native
-SystemCallFilter=@system-service
-SystemCallErrorNumber=EPERM
-CapabilityBoundingSet=
-RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=/run/chronoseal.pid
+
+# Logging
+StandardOutput=journal
+StandardError=journal
 
 [Install]
 WantedBy=multi-user.target