[Unit]
Description=Server Monitor dashboard (Linux metrics on 1024x768)
Documentation=file:/opt/server-monitor/README.md
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
WorkingDirectory=/opt/server-monitor
EnvironmentFile=-/etc/server-monitor.env
Environment=PYTHONUNBUFFERED=1
Environment=PYTHONDONTWRITEBYTECODE=1
ExecStart=/usr/bin/python3 /opt/server-monitor/monitor.py --bind 0.0.0.0 --port 8787
Restart=on-failure
RestartSec=2s
TimeoutStopSec=8s

# The dashboard only reads /proc, /sys and mount statistics.
DynamicUser=yes
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=read-only
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
LockPersonality=yes
SystemCallArchitectures=native
CapabilityBoundingSet=
AmbientCapabilities=
UMask=0077

[Install]
WantedBy=multi-user.target