[Unit]
Description=BastionGuard™ Secure Connection Daemon
Documentation=https://git.bastionguard.eu/specialworld83/bastionguard-secure-connection
After=network.target

[Service]
Type=simple
User=root
ExecStart=/usr/sbin/bsc-daemon \
    -rules-path /etc/bastionguard-secure-connectiond/rules \
    -ui-socket unix:///tmp/bsd-daemon.sock

Restart=on-failure
RestartSec=5s
TimeoutStopSec=5s

# Capabilities necessarie:
#   CAP_NET_ADMIN  -> nft (add table/chain/rule), NFQUEUE (nfq_create_queue)
#   CAP_NET_RAW    -> lettura header pacchetti grezzi
#   CAP_SYS_PTRACE -> lettura /proc/<pid>/{exe,cwd,environ} di altri processi
#   CAP_DAC_READ_SEARCH -> bypass permessi su /proc
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_PTRACE CAP_DAC_READ_SEARCH CAP_BPF CAP_PERFMON
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_PTRACE CAP_DAC_READ_SEARCH CAP_BPF CAP_PERFMON

# Hardening di base
NoNewPrivileges=true
ProtectSystem=full
ProtectHome=true
PrivateTmp=false

[Install]
WantedBy=multi-user.target