1 files changed, 37 insertions, 0 deletions
diff --git a/deploy/yesod.service b/deploy/yesod.service
new file mode 100644
index 0000000..6065a48
--- /dev/null
+++ b/deploy/yesod.service
@@ -0,0 +1,37 @@
+[Unit]
+Description=Yesod WebXR rooms (Networked-A-Frame + EasyRTC signaling)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=yesod
+Group=yesod
+WorkingDirectory=/opt/yesod
+EnvironmentFile=/etc/yesod/env
+ExecStart=/usr/bin/node server.js
+Restart=on-failure
+RestartSec=3
+
+# Hardening: the app only needs to read its own files and listen on localhost.
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+LockPersonality=yes
+CapabilityBoundingSet=
+SystemCallArchitectures=native
+MemoryMax=300M
+
+[Install]
+WantedBy=multi-user.target