systemd unit file for Isso server installed under /opt

isso.service

[Unit]
Description=Lightweight Disqus alternative
After=network-online.target
Wants=network-online.target

[Service]
User=isso
ExecStart=/opt/isso/venv/bin/isso -c isso.cfg run
Restart=on-failure

WorkingDirectory=/opt/isso
ReadWritePaths=/opt/isso
ReadOnlyPaths=/opt/isso/venv

# security options
NoNewPrivileges=yes
PrivateIPC=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict
ProtectHome=read-only
ProtectHostname=yes
ProtectClock=yes
ProtectProc=noaccess
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectKernelLogs=yes
RestrictAddressFamilies=AF_INET
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
# Misaka dependency uses CFFI
#MemoryDenyWriteExecute=yes
LockPersonality=yes

[Install]
WantedBy=multi-user.target