[Unit]
Description=DoH Forwarder - DNS-over-HTTPS forwarder
Documentation=https://gitea.logi.camp/LogiCrew/doh-forwarder
After=network.target

[Service]
Type=simple
User=doh-forwarder
Group=doh-forwarder
ExecStart=/usr/bin/doh-forwarder --config /etc/doh-forwarder/config.toml
Restart=on-failure
RestartSec=5

# Allow binding to port 53 without root
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ReadWritePaths=/var/lib/doh-forwarder

[Install]
WantedBy=multi-user.target