[Unit]
Description=WebVirtCloud serial console (socketiod; refuses connections unless SERIAL_CONSOLE_ENABLED)
Wants=network-online.target
After=network-online.target

[Service]
User=www-data
Group=www-data
WorkingDirectory=/srv/webvirtcloud
EnvironmentFile=-/etc/default/webvirtcloud
ExecStart=/srv/webvirtcloud/venv/bin/python3 /srv/webvirtcloud/console/socketiod
# gunicorn stops its worker itself; the consoles end with their ptys
KillMode=mixed
Restart=on-failure
RestartSec=10
# Sandbox: what the console daemons need (a pty and its worker, TCP and
# Unix sockets, ssh, writes under /srv and the user's ~/.ssh) and no more
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictSUIDSGID=yes
LockPersonality=yes

[Install]
WantedBy=multi-user.target