[Unit]
Description=dragoman PID redirection and content negotiation server
Documentation=https://codeberg.org/front-matter/dragoman
After=network.target
[Service]
Type=simple
User=dragoman
Group=dragoman
WorkingDirectory=/var/lib/dragoman
EnvironmentFile=/etc/dragoman/env
ExecStart=/usr/local/bin/dragoman start
Restart=on-failure
RestartSec=30
# Allow binding privileged ports (80, 443) as non-root
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
# Harden the service
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ReadWritePaths=/var/lib/dragoman /var/lib/commonmeta
ProtectHome=true
[Install]
WantedBy=multi-user.target