Package managed server for Linux production

deploy/linux/voicecat.service

@@ -1,23 +1,39 @@
 [Unit]
-Description=VoiceCat Voice & Text Server
-Documentation=https://github.com/org/voicecat
-After=network.target
+Description=VoiceCat encrypted voice server
+Documentation=https://github.com/Talon/voice-cat/blob/main/docs/deployment.md
+Wants=network-online.target
+After=network-online.target
 
 [Service]
 Type=simple
-User=voicecat
-Group=voicecat
-ExecStart=/usr/local/bin/voicecat-server --data-dir /var/lib/voicecat
+DynamicUser=yes
+StateDirectory=voicecat
+StateDirectoryMode=0700
+ExecStart=/usr/local/lib/voicecat/VoiceCat.Server --data-dir /var/lib/voicecat
 Restart=on-failure
 RestartSec=5s
-# Allow binding port 8384 without running as root
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-# Harden the process
-NoNewPrivileges=true
+TimeoutStopSec=15s
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateTmp=yes
 ProtectSystem=strict
-ProtectHome=true
-ReadWritePaths=/var/lib/voicecat
-PrivateTmp=true
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+ProcSubset=pid
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+CapabilityBoundingSet=
+AmbientCapabilities=
+UMask=0077
 
 [Install]
 WantedBy=multi-user.target