[Unit]
Description=ferrix_bgp teaching BGP speaker
After=network-online.target bird.service
Wants=network-online.target

[Service]
ExecStart=/usr/local/bin/ferrix-bgp /etc/ferrix-bgp/ferrix.textpb --level info
# SIGTERM makes ferrix send Cease / Administrative Shutdown to BIRD first.
KillSignal=SIGTERM
TimeoutStopSec=10
Restart=on-failure
RestartSec=5

# It needs the network and nothing else: no root, no privileged port, no
# write access anywhere. The one capability, CAP_NET_RAW, is for the ping
# monitor's raw ICMPv6 socket; drop both lines if ping_monitor is not
# configured.
DynamicUser=yes
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
AmbientCapabilities=CAP_NET_RAW
CapabilityBoundingSet=CAP_NET_RAW
MemoryMax=256M

[Install]
WantedBy=multi-user.target