[Unit]
Description=wgcloak UDP transport server
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=wgcloak
Group=wgcloak
ExecStart=/usr/bin/wgcloak server --config /etc/wgcloak/server.toml
Restart=on-failure
RestartSec=2s
TimeoutStopSec=15s
UMask=0077

# Keep the control socket in a private runtime directory.
RuntimeDirectory=wgcloak-server
RuntimeDirectoryMode=0750
Environment=XDG_RUNTIME_DIR=/run/wgcloak-server

# Process and filesystem hardening. Review paths if the deployment changes.
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
LockPersonality=true
RestrictSUIDSGID=true
RestrictNamespaces=true
RestrictRealtime=true
MemoryDenyWriteExecute=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native

# Ports below 1024 require this optional capability. Leave commented for the
# normal unprivileged configuration. Keep the bounding set this narrow.
# AmbientCapabilities=CAP_NET_BIND_SERVICE
# CapabilityBoundingSet=CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target