# InternetPressure.io probe agent — systemd unit (Linux).
# Installed by deploy/install.sh to /etc/systemd/system/ip-probe.service.
#
# ICMP without root: the agent opens an unprivileged ICMP datagram socket, which Linux only allows for groups
# inside net.ipv4.ping_group_range. The installer writes /etc/sysctl.d/60-ip-probe.conf with
#   net.ipv4.ping_group_range = 0 2147483647
# so no capability is required. Without it the agent falls back to TCP-connect "ping" (kind "tcp").
# Alternative (not recommended): uncomment AmbientCapabilities below to grant CAP_NET_RAW instead.
#
# traceroute: the system `traceroute` binary (UDP probes) must be installed (apt install traceroute /
# dnf install traceroute). Modern traceroute needs no root for UDP probes when ping_group_range is set;
# otherwise the binary is usually setuid or has file capabilities set by the distribution.

[Unit]
Description=InternetPressure.io probe agent
Documentation=https://www.internetpressure.io/probes
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=ip-probe
Group=ip-probe
DynamicUser=no
ExecStart=/usr/local/bin/ip-probe run --config /etc/internetpressure/probe.yaml
WorkingDirectory=/var/lib/internetpressure
Restart=always
RestartSec=5
TimeoutStopSec=15
KillSignal=SIGTERM

# Uncomment to use raw sockets instead of net.ipv4.ping_group_range (not needed when the sysctl is set):
#AmbientCapabilities=CAP_NET_RAW
#CapabilityBoundingSet=CAP_NET_RAW

# Hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/internetpressure /usr/local/bin/ip-probe
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
SystemCallArchitectures=native
LimitNOFILE=4096
MemoryMax=256M

[Install]
WantedBy=multi-user.target