[Unit]
Description=Onion Newsreader Anonymous NNTP Client
After=network.target tor.service
Wants=tor.service
Documentation=https://github.com/gabrix73/onion-newsreader.git

[Service]
Type=simple
User=newsreader
Group=newsreader
WorkingDirectory=/opt/onion-newsreader
ExecStart=/opt/onion-newsreader/bin/onion-newsreader
ExecReload=/bin/kill -HUP $MAINPID
EnvironmentFile=/etc/onion-newsreader/environment

# Security
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/onion-newsreader /var/log/onion-newsreader
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
RestrictNamespaces=true
LockPersonality=true
MemoryDenyWriteExecute=true
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM

# Restart policy
Restart=always
RestartSec=10
StartLimitInterval=60
StartLimitBurst=3

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=onion-newsreader

[Install]
WantedBy=multi-user.target