# /etc/systemd/system/ferrix.service
#
# Runs the Ferrix daemon as an unprivileged user, with only the
# capabilities that it requires, and restricts its access to the system.
# The log is written to the journal: journalctl -u ferrix.
[Unit]
Description=Ferrix BGP daemon
Documentation=https://ferrix.rayhaan.net/docs/
Wants=network-online.target
After=network-online.target

[Service]
Type=exec
User=ferrix
Group=ferrix
# Validate the configuration before starting. An invalid configuration
# prevents the start, and the error is written to the journal.
ExecStartPre=/usr/local/bin/bgp --check /etc/ferrix/server.textpb
ExecStart=/usr/local/bin/bgp /etc/ferrix/server.textpb --level info
Restart=on-failure
RestartSec=5s
# On SIGUSR1 the daemon leaves its routes in place for a graceful restart
# and exits with status 75: start it again at once.
SuccessExitStatus=75
RestartForceExitStatus=75
# Time to notify all neighbors and remove the kernel routes.
TimeoutStopSec=30s

# TCP port 179, and the kernel routing table.
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
NoNewPrivileges=yes

# BGP, RTR, HTTP, and netlink sockets only.
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_UNIX
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
UMask=0077

[Install]
WantedBy=multi-user.target