tarpyt@.service.in

[Unit]
Description=An @PROTOCOL@ tarpit on port %i
Requires=tarpyt-@PROTOCOL@@%i.socket

[Service]
Type=notify
ExecStart=@bindir@/tarpyt --protocol @PROTOCOL@ --log-level INFO
LogExtraFields=SYSLOG_IDENTIFIER="tarpyt-@PROTOCOL@-%i"

# Low CPU priority/resources
Nice=19
CPUWeight=idle
CPUQuota=10%
CPUSchedulingPolicy=idle

# Bound memory to prevent DDOS
# (20 MiB should be enough for anyone)
MemoryHigh=20M
ManagedOOMMemoryPressure=kill

# Run as a random user in a user namespace
PrivateUsers=yes
DynamicUser=yes

# Sandboxing
NoNewPrivileges=yes
CapabilityBoundingSet=
ProtectSystem=strict
ProtectHome=yes
PrivateDevices=yes
ProtectProc=invisible
PrivateTmp=yes
PrivateNetwork=yes
PrivateIPC=yes
ProtectHostname=yes
ProtectClock=yes
ProtectKernelLogs=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
KeyringMode=private
MemoryDenyWriteExecute=yes
PrivateMounts=yes
SystemCallFilter=@system-service
SystemCallArchitectures=native
DevicePolicy=closed
IPAddressDeny=any
ReadOnlyPaths=/
InaccessiblePaths=/etc /var