git init

agent/packaging/vps-agent.service

@@ -0,0 +1,50 @@
+[Unit]
+Description=VPS Control monitoring agent
+Documentation=https://github.com/example/vps-control
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=vps-agent
+Group=vps-agent
+ExecStart=/usr/local/bin/vps-agent --config /etc/vps-agent/config.toml
+Restart=on-failure
+RestartSec=5s
+TimeoutStopSec=15s
+
+# Resource controls
+MemoryHigh=48M
+MemoryMax=64M
+CPUQuota=10%
+TasksMax=64
+
+# Filesystem and privilege hardening
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+RestrictSUIDSGID=true
+LockPersonality=true
+RestrictRealtime=true
+RestrictNamespaces=true
+CapabilityBoundingSet=
+AmbientCapabilities=
+SystemCallArchitectures=native
+UMask=0077
+
+# Read-only host information and bounded address families.
+ProcSubset=all
+ProtectProc=invisible
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+
+[Install]
+WantedBy=multi-user.target
+