[Unit]
Description=Truf privileged host operations agent
Requires=truf-host-agent.socket docker.service
After=truf-host-agent.socket docker.service

[Service]
Type=exec
User=root
Group=root
UMask=0077
WorkingDirectory=/
ExecStartPre=/usr/bin/python3 -I -B /usr/lib/truf-host-agent/truf_host_agent_install.py validate
ExecStart=/usr/bin/python3 -I -B /usr/lib/truf-host-agent/truf_host_agent.py
RuntimeDirectory=truf-host-agent
RuntimeDirectoryMode=0700
NoNewPrivileges=yes
CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER
AmbientCapabilities=
PrivateTmp=yes
PrivateDevices=yes
PrivateNetwork=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
ProtectProc=invisible
ProcSubset=pid
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
ReadWritePaths=/etc/truf/runtime
ReadWritePaths=/var/lib/truf/host-agent
ReadWritePaths=/run/truf-host-agent
ReadWritePaths=/run/docker.sock
ReadOnlyPaths=/usr/lib/truf-host-agent
ReadOnlyPaths=/opt/truf
ReadOnlyPaths=/var/lib/truf/runtime-document-candidates
ReadOnlyPaths=/run/truf-postgres
Restart=no
TimeoutStopSec=45min
StandardOutput=null
StandardError=journal