[Unit]
Description=BastionGuard DNS Protection Daemon
After=network.target dnsmasq.service
Wants=dnsmasq.service
StartLimitBurst=5
StartLimitIntervalSec=30

[Service]
Type=simple

# Capability per bind su 81/444 (no root richiesto)
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE



WorkingDirectory=/usr/share/BastionGuard
StandardOutput=journal
StandardError=journal
SyslogIdentifier=BastionGuard-daemon

# Avvio del daemon con LocalWarningServer
ExecStart=/usr/bin/BastionGuard-daemon \
    --http-port=81 \
    --https-port=444 \
    --bind-address=127.0.0.2 \
    --page-warning=/usr/share/BastionGuard/data/blocking/block.html

# Reload: ricarica dnsmasq in caso di aggiornamento blocklist
ExecReload=/usr/libexec/bastionguard/bastionguard-service --system reload dnsmasq.service

# Restart automatico su crash
Restart=on-failure
RestartSec=5s
TimeoutStopSec=5s
KillSignal=SIGTERM
KillMode=control-group

# Sicurezza e isolamento
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
RestrictRealtime=true
RestrictSUIDSGID=true
ProtectKernelModules=true
ProtectControlGroups=true
ProtectClock=true

[Install]
WantedBy=multi-user.target