Revise systemd service configuration for Yellowstone Jet (#115)

* Revise systemd service configuration for Yellowstone Jet

Updated the systemd service configuration for Yellowstone Jet, including configuring resource limits and security settings.

* jet service file

Author: ananthb

README.md

@@ -34,43 +34,14 @@ A sample configuration file can be found [config.yml](https://github.com/rpcpool
 
 ### Systemd
 
-Running Jet as a service under SystemD is our recommended approach. A sample systemd file:
+Running Jet as a service under SystemD is our recommended approach. A sample systemd file is provided at [systemd/yellowstone-jet.service](systemd/yellowstone-jet.service).
 
-```
-[Unit]
-Description=Yellowstone Jet transaction forwarder
-After=network-online.target
-StartLimitInterval=0
-StartLimitIntervalSec=0
-
-[Service]
-Type=simple
-User=yellowstone-jet
-Group=yellowstone-jet
-PermissionsStartOnly=true
-ExecStart=/usr/local/bin/yellowstone-jet --config /etc/yellowstone-jet.yml
-
-Environment=RUST_LOG="warn"
-
-SyslogIdentifier=yellowstone-jet
-KillMode=process
-Restart=always
-RestartSec=5
-
-LimitNOFILE=700000
-LimitNPROC=700000
-
-LockPersonality=true
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectHome=true
-RemoveIPC=true
-RestrictSUIDSGID=true
-
-ProtectSystem=full
-
-[Install]
-WantedBy=multi-user.target
+To install:
+
+```bash
+sudo cp systemd/yellowstone-jet.service /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now yellowstone-jet
 ```
 
 ## Attribution

systemd/yellowstone-jet.service

@@ -0,0 +1,49 @@
+[Unit]
+Description=Yellowstone Jet transaction forwarder
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+DynamicUser=yes
+ConfigDirectory=yellowstone-jet
+
+ExecStart=/usr/local/bin/yellowstone-jet --config /etc/yellowstone-jet/config.yml
+
+Environment=RUST_LOG="warn"
+Restart=always
+RestartSec=5
+
+# Resource Limits
+LimitNOFILE=700000
+LimitNPROC=700000
+
+# File System Sandboxing
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectHostname=yes
+ProtectClock=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RemoveIPC=yes
+PrivateUsers=yes
+
+# Privilege Escalation & System Calls
+NoNewPrivileges=yes
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=multi-user.target