# ProtectHome=yes hides /home from the node: keep a commit_rpc cookie outside /home.
[Unit]
Description=URMA Node
Wants=network-online.target
After=network-online.target
[Service]
Type=simple
User=urma-node
Group=urma-node
ExecStart=@BIN@ service run
Restart=on-failure
RestartSec=10s
UMask=0077
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=@STATE@
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
LockPersonality=yes
RestrictNamespaces=yes
SystemCallArchitectures=native
CapabilityBoundingSet=
KillSignal=SIGTERM
TimeoutStopSec=30s
[Install]
WantedBy=multi-user.target