[Unit]
Description=VibeDNS - The AI generated DNS server designed to solve an idiots neiche problems
Documentation=https://github.com/owen/vibedns
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=vibedns
Group=vibedns

ExecStart=/usr/local/bin/vibedns serve \
    --db /var/lib/vibedns/dns.db \
    --http 127.0.0.1:8080 \
    --dns 0.0.0.0:53

# The administrator password is generated on first start and printed to the
# journal exactly once. To set your own instead, put it in an environment file
# readable only by root and uncomment the line below:
#   echo 'VIBEDNS_ADMIN_PASSWORD=...' > /etc/vibedns.env && chmod 600 /etc/vibedns.env
# EnvironmentFile=-/etc/vibedns.env

Restart=on-failure
RestartSec=5s

# Binding port 53 without running as root. This is the whole reason the service
# can drop to an unprivileged user.
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

# The database and backups are the only paths that need to be writable.
StateDirectory=vibedns
StateDirectoryMode=0750
ReadWritePaths=/var/lib/vibedns

# Sandboxing. Each of these closes off something a DNS server has no business
# touching, so a flaw in parsing a hostile response has far less to work with.
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
ProtectProc=invisible
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
UMask=0077

# Resource ceilings. A DNS server holds many concurrent sockets; the memory
# limit is generous enough for a large cache plus several big blocklists.
LimitNOFILE=65535
MemoryMax=2G
TasksMax=512

# Journal identification
SyslogIdentifier=vibedns

[Install]
WantedBy=multi-user.target