[Unit]
Description=DNSBunker: aggregierte Zähler für die Website-Statistik
After=dnsdist.service
Wants=dnsdist.service

[Service]
Type=oneshot
User=dnsbunker-stats
Group=dnsbunker-stats
ExecStart=/usr/local/sbin/dnsbunker-stats
LoadCredential=apikey:/etc/dnsbunker-stats/apikey
RuntimeDirectory=dnsbunker-stats
RuntimeDirectoryMode=0755
RuntimeDirectoryPreserve=yes
UMask=0022
Nice=10
IOSchedulingClass=idle
NoNewPrivileges=yes
CapabilityBoundingSet=
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
ProtectProc=invisible
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
IPAddressAllow=localhost
IPAddressDeny=any
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM