[Unit]
Description=TERA privileged dual-Ethernet configuration adapter
After=local-fs.target network-pre.target
Before=network-online.target tera-api.service

[Service]
Type=simple
User=root
Group=tera
EnvironmentFile=-/etc/tera/tera-netd.env
ExecStart=/usr/bin/tera-netd
Restart=on-failure
RestartSec=2s
RuntimeDirectory=tera-netd
RuntimeDirectoryMode=0750
StateDirectory=tera-network
StateDirectoryMode=0700
UMask=0007
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
PrivateDevices=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
RestrictAddressFamilies=AF_UNIX AF_NETLINK
RestrictSUIDSGID=true
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
ReadWritePaths=/run/tera-netd /var/lib/tera-network /etc/network

[Install]
WantedBy=multi-user.target