[Unit]
Description=NX9 WireGuard Appliance Management Engine
Documentation=https://github.com/thakares/nx9-wg
After=network.target network-online.target
Wants=network-online.target

[Service]
Type=simple
User=root
Group=root

# Environment configuration file (optional override)
EnvironmentFile=-/etc/nx9-wg/nx9-wg.env

# Working directory and execution
WorkingDirectory=/var/lib/nx9-wg
ExecStart=/usr/local/bin/nx9-wg --config /etc/nx9-wg/config.toml --data-dir /var/lib/nx9-wg serve

# Process management and restart policy
Restart=always
RestartSec=5s
KillMode=process
TimeoutStopSec=15s

# Linux Capabilities for Native Netlink & Port Binding
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
NoNewPrivileges=true

# Sandboxing and System Hardening
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=false
RestrictRealtime=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK

# Kernel procfs IP forwarding management requires procfs writes
ProtectKernelTunables=false

# Systemd managed state, configuration, and log directories
StateDirectory=nx9-wg
ConfigurationDirectory=nx9-wg
LogsDirectory=nx9-wg
ReadWritePaths=/var/lib/nx9-wg /etc/nx9-wg /var/log/nx9-wg /proc/sys/net

# Resource Limits
LimitNOFILE=65536
LimitNPROC=4096

[Install]
WantedBy=multi-user.target