#-----------------------------------------------------------------------
# initiate:   systemctl enable web2ldap_uwsgi.service
# start:      systemctl start web2ldap_uwsgi.service
# get status: systemctl status web2ldap_uwsgi.service
#-----------------------------------------------------------------------

[Unit]
Description=web2ldap - web-based LDAPv3 client (uwsgi)
Requires=local-fs.target network.target
After=local-fs.target network.target

[Service]
Type=simple
Environment=LDAPNOINIT=1
Environment=PYTHONOPTIMIZE=2
Environment=PYTHONDONTWRITEBYTECODE=1
ExecStart=/usr/sbin/uwsgi --ini /etc/uwsgi/web2ldap.ini
User=web2ldap
Group=web2ldap
Restart=always
KillSignal=SIGQUIT
RuntimeDirectory=web2ldap
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
#AppArmorProfile=web2ldap
# various hardening options
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=full
ProtectHome=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes
NoNewPrivileges=yes
MountFlags=private
SystemCallArchitectures=native
LockPersonality=yes
KeyringMode=private
RestrictRealtime=yes
RestrictNamespaces=yes
SystemCallFilter=~ @clock @cpu-emulation @debug @keyring @module @mount @raw-io @reboot @swap @obsolete

[Install]
WantedBy=multi-user.target
