[Unit]
Description=forge self-hosted git forge
After=network-online.target
Wants=network-online.target
StartLimitIntervalSec=60
StartLimitBurst=5

[Service]
Type=simple
User=forge
Group=forge
Environment=FORGE_CONFIG=/etc/forge/forge.toml
ExecStart=/usr/local/bin/forge serve
WorkingDirectory=/var/lib/forge
Restart=on-failure
RestartSec=2
LimitNOFILE=65536

# Hardening
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
# backups dir is optional, keep in sync with `[backup] dir`
ReadWritePaths=/var/lib/forge -/var/backups/forge
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictSUIDSGID=yes
RestrictRealtime=yes
RestrictNamespaces=yes
LockPersonality=yes
SystemCallArchitectures=native
CapabilityBoundingSet=
AmbientCapabilities=
UMask=0077

[Install]
WantedBy=multi-user.target