Systemd service unit templates for bots

bot@.service

# symlink to /etc/systemd/system/

[Unit]
Description=%I bot
After=network.target

[Service]
Type=simple
WorkingDirectory=/home/fionn/bots/%i/
EnvironmentFile=/home/fionn/bots/%i/.env
ExecStart=/home/fionn/bots/%i/venv/bin/python -u src/main.py
Restart=on-failure
RestartSec=900

DynamicUser=true
PrivateDevices=true
ProtectHostname=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
SystemCallArchitectures=native
LockPersonality=true
MemoryDenyWriteExecute=true
InaccessiblePaths=/dev /boot
RestrictRealtime=true
PrivateMounts=true
MountFlags=private
PrivateUsers=true
UMask=0777
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=yes
CapabilityBoundingSet=
AmbientCapabilities=
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
ProtectKernelLogs=true

bot@.timer

# symlink to /etc/systemd/system/

[Unit]
Description=%I bot timer

[Timer]
OnCalendar=*:0/10

[Install]
WantedBy=timers.target