[Unit]
Description=Mirror Tool TCP mirror and upstream router
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=mirror-tool
Group=mirror-tool
WorkingDirectory=/var/lib/mirror-tool
EnvironmentFile=/etc/mirror-tool/mirror.env
ExecStart=/usr/local/bin/mirror-tool --config /etc/mirror-tool/mirror.toml
Restart=on-failure
RestartSec=3
TimeoutStopSec=45
StateDirectory=mirror-tool
StateDirectoryMode=0700
UMask=0077
LimitNOFILE=131072
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target