# Public Matrix admin UI: a separate unprivileged, sandboxed identity.
# The root-owned binary and non-secret config remain read-only outside Nix.
# StateDirectory is deliberately DIFFERENT from the executable directory:
# systemd must never make the binary/config writable by the service user.
{ ... }:
{
  systemd.services.tuwunel-admin = {
    description = "tuwunel-admin (Matrix admin web UI)";
    after = [ "network-online.target" ];
    wants = [ "network-online.target" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "simple";
      DynamicUser = true;
      User = "tuwunel-admin";
      StateDirectory = "tuwunel-admin-state";
      StateDirectoryMode = "0700";
      WorkingDirectory = "/var/lib/tuwunel-admin-state";
      Environment = [ "HOME=/var/lib/tuwunel-admin-state" ];
      ExecStart = "/var/lib/tuwunel-admin/tuwunel-admin --config /var/lib/tuwunel-admin/config.toml";
      Restart = "on-failure";
      RestartSec = 5;
      UMask = "0077";
      NoNewPrivileges = true;
      ProtectSystem = "strict";
      ProtectHome = true;
      PrivateTmp = true;
      PrivateDevices = true;
      ProtectKernelTunables = true;
      ProtectKernelModules = true;
      ProtectKernelLogs = true;
      ProtectControlGroups = true;
      ProtectClock = true;
      RestrictSUIDSGID = true;
      RestrictNamespaces = true;
      LockPersonality = true;
      CapabilityBoundingSet = "";
      AmbientCapabilities = "";
      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
      MemoryMax = "256M";
      TasksMax = 128;
    };
  };
}