packetyeeter-collector.service

[Unit]
Description=PacketYeeter Collector - eBPF-based packet collection and enforcement
Documentation=https://github.com/awlx/packetyeeter
After=network.target
Wants=packetyeeter-analyzer.service

[Service]
Type=simple
# Required (not "-/etc/default/..."): native systemd does not run ExecStart
# through a shell, so it cannot fall back to inline defaults like bash's
# ${VAR:-default}. All values below must come from this file, which is
# shipped with real defaults by the package. If the file is missing, refuse
# to start rather than silently launching with empty/garbage arguments.
EnvironmentFile=/etc/default/packetyeeter-collector
ExecStart=/opt/packetyeeter/collector/packetyeeter-collector \
    -i ${INTERFACE} \
    -analyzer-addr ${ANALYZER_ADDR} \
    -metrics-addr ${METRICS_ADDR} \
    -haproxy-port ${HAPROXY_PORT} \
    -spoe-port ${SPOE_PORT} \
    -socket ${SOCKET_PATH} \
    -geoip-asn ${GEOIP_ASN_PATH} \
    -block-duration ${BLOCK_DURATION} \
    ${EXTRA_ARGS}
Restart=on-failure
RestartSec=5
LimitMEMLOCK=infinity
LimitNOFILE=65535

# Security
# The collector loads eBPF, attaches XDP/TC programs, and manages kernel maps.
# Keep these capabilities and memlock unless the full BPF attach path has been
# validated on the target kernel with stricter hardening.
NoNewPrivileges=false
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_NET_ADMIN CAP_BPF CAP_PERFMON CAP_NET_RAW
AmbientCapabilities=CAP_SYS_ADMIN CAP_NET_ADMIN CAP_BPF CAP_PERFMON CAP_NET_RAW

[Install]
WantedBy=multi-user.target