constellation-dns.service

[Unit]
Description=Constellation DNS server
Documentation=https://github.com/your-org/constellation-dns
After=network.target

[Service]
# Run as a specific user (modify as needed)
# User=constellation
# Group=constellation

# Path to the executable (adjust path as needed)
ExecStart=/usr/local/bin/constellation-dns

# Configuration
# By default, looks for config at /etc/constellation-dns/config.toml
# Uncomment and modify if needed:
# ExecStart=/usr/local/bin/constellation-dns --config /path/to/custom/config.toml

# Restart on failure
Restart=on-failure
RestartSec=5s

# Security measures
ProtectSystem=full
PrivateTmp=true
ProtectHome=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
PrivateDevices=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=true
RestrictRealtime=true
MemoryDenyWriteExecute=true

# Allow binding to privileged port 53 (DNS)
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target