[Unit]
Description=hc-cpapi-audit daemon (cPanel API abuse detection, PHWS-43552)
After=auditd.service
Wants=auditd.service

[Service]
Type=simple
# Gate startup on config validity so a bad deploy fails here, not half-up.
ExecStartPre=/usr/bin/hc-cpapi-audit --config /etc/hc-cpapi-audit/config.yaml --check-config
ExecStart=/usr/bin/hc-cpapi-audit --config /etc/hc-cpapi-audit/config.yaml
# Root: reads /var/log/audit/audit.log (0600 root), /var/cpanel/userdata, and
# per-user domlogs. Contained by the sandbox below.
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/var/log/hc-cpapi-audit /var/lib/hc-cpapi-audit /var/lib/node_exporter
ReadOnlyPaths=/var/log/audit /var/cpanel
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
LockPersonality=true
Restart=always
RestartSec=5
MemoryMax=256M
Nice=10
IOSchedulingClass=idle
# CPython exits 120 when flushing std streams during finalization (severed
# journald stream on a long-lived process). The work completed; don't flag it.
SuccessExitStatus=120
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target