[Unit]
Description=txt3 BBS (telnet front-end for wap.txt3.net)
Documentation=https://wap.txt3.net/about.php
After=network-online.target tailscaled.service
Wants=network-online.target

[Service]
Type=simple
User=txt3
Group=txt3
WorkingDirectory=/home/txt3/domains/wap.txt3.net/bbs
ExecStart=/usr/bin/python3 /home/txt3/domains/wap.txt3.net/bbs/bbsd.py
Environment=BBS_HOST=100.127.96.105
Environment=BBS_PORT=12300
Environment=BBS_DB=/home/txt3/domains/wap.txt3.net/public_html/data/wap.sqlite
Environment=BBS_PHP=/usr/bin/php
Environment=PYTHONUNBUFFERED=1

# The service only ever needs its own code, the shared sqlite db, and php for
# bcrypt hashing. Everything else is locked down.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/home/txt3/domains/wap.txt3.net/public_html/data
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictNamespaces=yes
RestrictSUIDSGID=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
LockPersonality=yes
MemoryDenyWriteExecute=no
# tailscale-only listener, so no need for extra port capabilities
CapabilityBoundingSet=

Restart=on-failure
RestartSec=5
StandardOutput=append:/home/txt3/domains/wap.txt3.net/bbs/bbs.log
StandardError=append:/home/txt3/domains/wap.txt3.net/bbs/bbs.log

[Install]
WantedBy=multi-user.target