[Unit]
Description=ChronoSeal Anti-Bot Service
After=network.target

[Service]
Type=simple

User=chronoseal
Group=chronoseal

WorkingDirectory=/opt/chronoseal

ExecStart=/usr/local/bin/chronoseal

Restart=always
RestartSec=3

NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true

MemoryDenyWriteExecute=true
RestrictRealtime=true
RestrictSUIDSGID=true

LockPersonality=true

SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target