[Unit]
Description=InfluxDB 3 Core time-series database
Documentation=https://docs.influxdata.com/influxdb3/core/
After=network.target

[Service]
Type=simple
User=influxdb
Group=influxdb
EnvironmentFile=/etc/influxdb/influxdb.env
ExecStart=/usr/bin/influxdb3 serve
Restart=on-failure
RestartSec=5

# Security hardening — landing plan §5e baseline
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectHostname=yes
ProtectClock=yes
ProtectProc=invisible
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=true
RemoveIPC=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
CapabilityBoundingSet=
AmbientCapabilities=
ReadWritePaths=/var/lib/influxdb /var/log/influxdb /run/influxdb
ReadOnlyPaths=/etc/influxdb
UMask=0077

[Install]
WantedBy=multi-user.target
