[Unit]
Description = Netbird Service (%i)
Documentation = https://netbird.io/docs
After = network-online.target syslog.target
Wants = network-online.target

[Service]
Type = simple
EnvironmentFile = -/etc/default/netbird
ExecStart = /usr/bin/netbird service run --config /etc/netbird/%i.json --log-file console $NETBIRD_CLIENT_ARGS
Restart = on-failure
RestartSec = 5
TimeoutStopSec = 10

CacheDirectory=netbird
ConfigurationDirectory=netbird
LogsDirectory=netbird
RuntimeDirectory=netbird
StateDirectory=netbird

LockPersonality = yes
MemoryDenyWriteExecute = yes
NoNewPrivileges = yes
PrivateMounts = yes
PrivateTmp = yes
ProtectClock = yes
ProtectControlGroups = yes
ProtectHome = yes
ProtectHostname = yes
ProtectKernelLogs = yes
ProtectKernelModules = no
ProtectKernelTunables = no
ProtectSystem = yes
RemoveIPC = yes
RestrictNamespaces = yes
RestrictRealtime = yes
RestrictSUIDSGID = yes

[Install]
WantedBy = multi-user.target

