[Unit]
Description=ZDOS Resident Organism Supervisor
After=local-fs.target
ConditionPathExists=/usr/local/lib/zdos/organism/main.zlang
ConditionPathExists=/usr/local/lib/zdos/organism/zdos-organismd.py
StartLimitIntervalSec=60
StartLimitBurst=3

[Service]
Type=simple
User=zdos
Group=zdos
WorkingDirectory=/var/lib/zdos/organism
Environment=ZDOS_ORGANISM_STATE_DIR=/var/lib/zdos/organism
Environment=ZDOS_ORGANISM_PROGRAM=/usr/local/lib/zdos/organism/main.zlang
Environment=ZDOS_ZLANG_ROOT=/usr/local/lib/zdos/Zlang
ExecStart=/usr/bin/python3 /usr/local/lib/zdos/organism/zdos-organismd.py
Restart=on-failure
RestartSec=5
UMask=0077
NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
ProtectHostname=yes
ProtectClock=yes
ProtectProc=invisible
ProcSubset=pid
ReadWritePaths=/var/lib/zdos/organism
RestrictAddressFamilies=AF_UNIX
IPAddressDeny=any
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target