vaultwarden systemctl hardened service (OLD)

vaultwarden.service

root@nibbler:/etc/systemd/system# cat bitwarden_rs.service
[Unit]
Description=Bitwarden Server (Rust Edition)
Documentation=https://github.com/dani-garcia/bitwarden_rs

# Only sqlite
After=network.target

[Service]
User=bitwarden
Group=bitwarden
ExecStart=/home/bitwarden/bitwarden_rs
LimitNOFILE=1048576
LimitNPROC=64
MemoryAccounting=true
MemoryMax=128M
CPUQuota=25%
IOWeight=20
CPUWeight=25
# Isolate bitwarden_rs from the rest of the system
Type=simple
PrivateTmp=true
PrivateDevices=true
ProtectHome=read-only
ProtectSystem=full
NoNewPrivileges=yes
PrivateUsers=yes
ProtectControlGroups=true
ProtectKernelTunables=true
RestrictSUIDSGID=true
CapabilityBoundingSet=
ProtectProc=true
RestrictNamespaces=uts ipc pid user cgroup
# Only allow writes to the following directory and set it to the working directory (user and password data are stored here)
ReadOnlyDirectories=/home/bitwarden
WorkingDirectory=/home/bitwarden
ReadWriteDirectories=-/home/bitwarden/data
# Allow bitwarden_rs to bind ports in the range of 0-1024
# AmbientCapabilities=CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target

# vim: ft=config