[Unit]
# The protection half of the rig's supervision, and the only piece that must be
# root. See /usr/local/bin/parvagues-protect for the full story; the short
# version is that systemd's user manager ships DefaultOOMScoreAdjust=200, a
# --user unit cannot go below 100 (it clamps SILENTLY), and so every restart of
# parvagues-sc.service handed scsynth back as the most killable process on the
# machine until something re-protected it by hand.
#
# SEPARATE FROM THE WATCHDOG ON PURPOSE. The watchdog decides WHETHER a process
# should be running; this decides HOW it runs once it is. Folding them together
# would put a root daemon on the restart path, where a bug stops the music — out
# here, a bug is merely noisy and the rig keeps playing unprotected.
#
# NO PartOf=/BindsTo= on the user unit, for the reason the watchdog documents at
# length: PartOf propagates restarts, and a supervisor that dies with the thing
# it supervises launders its own state. This one is independent of everything —
# it holds no ports, makes no sound, and only ever edits attributes of processes
# that already exist.
Description=ParVagues process protection (OOM immunity + realtime priority)
Documentation=file:/usr/local/bin/parvagues-protect
After=multi-user.target

[Service]
Type=simple
ExecStart=/usr/local/bin/parvagues-protect
# It adjusts other processes; it must not be a realtime process itself, and it
# must never be the reason the machine is short of anything.
Nice=10
IOSchedulingClass=idle
# If it dies it is a protection outage, not an audio outage — come straight back.
Restart=always
RestartSec=5
StandardOutput=journal
StandardError=journal
SyslogIdentifier=pv-protect

# It needs exactly two powers: lower oom_score_adj past the caller's floor, and
# set SCHED_FIFO on processes it does not own. Nothing else.
CapabilityBoundingSet=CAP_SYS_RESOURCE CAP_SYS_NICE CAP_IPC_LOCK
AmbientCapabilities=CAP_SYS_RESOURCE CAP_SYS_NICE CAP_IPC_LOCK
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=read-only
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM

[Install]
WantedBy=multi-user.target
