[Unit]

### see man systemd.unit

Description=Prosody XMPP Server

Documentation=https://prosody.im/doc

[Service]

### See man systemd.service ###

# With this configuration, systemd takes care of daemonization

# so Prosody should be configured with daemonize = false

Type=simple

# Not sure if this is needed for 'simple'

PIDFile=/var/run/prosody/prosody.pid

# Start by executing the main executable

ExecStart=/usr/bin/prosody

ExecReload=/bin/kill -HUP $MAINPID

# Restart on crashes

Restart=on-abnormal

# Set O_NONBLOCK flag on sockets passed via socket activation

NonBlocking=true

### See man systemd.exec ###

WorkingDirectory=/var/lib/prosody

User=prosody

Group=prosody

UMask=0027

# Nice=0

# Set stdin to /dev/null since Prosody does not need it

StandardInput=null

# Direct stdout/-err to journald for use with log = "*stdout"

StandardOutput=journal

StandardError=inherit

# This usually defaults to 4k or so

# LimitNOFILE=1M

## Interesting protection methods

# Finding a useful combo of these settings would be nice

#

# Needs read access to /etc/prosody for config

# Needs write access to /var/lib/prosody for storing data (for internal storage)

# Needs write access to /var/log/prosody for writing logs (depending on config)

# Needs read access to code and libraries loaded

# ReadWriteDirectories=/var/lib/prosody /var/log/prosody

# InaccessibleDirectories=/boot /home /media /mnt /root /srv

# ReadOnlyDirectories=/usr /etc/prosody

# PrivateTmp=true

# PrivateDevices=true

# PrivateNetwork=false

# ProtectSystem=full

# ProtectHome=true

# ProtectKernelTunables=true

# ProtectControlGroups=true

# SystemCallFilter=

# This should break LuaJIT

# MemoryDenyWriteExecute=true