# The platform STUN/TURN relay (media roadmap stage 4a). Armed only on a
# box that carries /etc/carlos/relay-masters; ConditionPathExists keeps a
# box without a master from ever listening. Shares the box with the edge and
# must lose first: bounded memory, PSI-driven shedding in the process, and
# the highest OOM adjustment there is.
[Unit]
Description=carlos relay (STUN and TURN)
After=network-online.target
Wants=network-online.target
ConditionPathExists=/etc/carlos/relay-masters

[Service]
EnvironmentFile=-/etc/carlos/host.env
ExecStart=/opt/carlos/carlos relay serve
Restart=always
RestartSec=1

User=carlos
Group=carlos
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/data/relay /run/carlos
PrivateTmp=yes
PrivateDevices=yes
ProtectClock=yes
ProtectHostname=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectProc=invisible
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
SystemCallArchitectures=native
MemoryHigh=160M
MemoryMax=256M
OOMScoreAdjust=1000
TasksMax=512
Nice=5
CPUWeight=50

[Install]
WantedBy=multi-user.target