package host

const claimBoundTemplate = `[Unit]
Description=carlos exec-backed instance %I
Requires=data-instances.mount run-carlos-instances.mount run-carlos-logs.mount
After=data-instances.mount run-carlos-instances.mount run-carlos-logs.mount

[Service]
Type=simple
ExecStart=/opt/carlos/carlos instance-exec run %I
ExecStopPost=/opt/carlos/carlos instance-exit run %I
User=carlos
Group=carlos
Slice=carlos-instances-%i.slice
Restart=no
KillMode=mixed
TimeoutStopSec=20
SuccessExitStatus=129 130 141 143
StandardOutput=file:/run/carlos/logs/%I.run.sock
StandardError=inherit
BindPaths=/data/instances/%I /run/carlos/instances/%I
ReadWritePaths=/data/instances/%I /run/carlos/instances/%I
WorkingDirectory=/data/instances/%I
BindReadOnlyPaths=/run/carlos-control/exe/%I/app:/opt/carlos/app /run/carlos-control/exe/%I/live:/opt/carlos/live

ProtectSystem=strict
TemporaryFileSystem=/data:ro
TemporaryFileSystem=/run/carlos:ro
TemporaryFileSystem=/var/cache:ro
TemporaryFileSystem=/var/lib:ro
TemporaryFileSystem=/opt/carlos:ro
BindReadOnlyPaths=/opt/carlos/carlos
InaccessiblePaths=/etc/carlos /run/carlos-control
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
TemporaryFileSystem=/dev/shm:mode=1777,nosuid,nodev
PrivateIPC=yes
TemporaryFileSystem=/dev/mqueue:ro
ProtectControlGroups=yes
ProtectProc=invisible
ProcSubset=pid
PrivatePIDs=yes
RestrictNamespaces=yes
NoNewPrivileges=yes
CapabilityBoundingSet=
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
IPAddressDeny=localhost multicast 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 169.254.0.0/16 169.254.169.254/32 172.16.0.0/12 192.0.0.0/24 192.168.0.0/16 198.18.0.0/15 240.0.0.0/4 64:ff9b::/96 fc00::/7 fd00:ec2::254/128 fe80::/10 fec0::/10
BindReadOnlyPaths=-/run/systemd/resolve/resolv.conf:/etc/resolv.conf
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectClock=yes
ProtectHostname=yes
RemoveIPC=yes
LockPersonality=yes
RestrictRealtime=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native

TasksMax=256
OOMScoreAdjust=500
OOMPolicy=kill
`