[Unit]
Description=NODE.DC B2 VPS private Tailscale transport
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
User=nodedc-edge
Group=nodedc-edge
RuntimeDirectory=nodedc-b2-vps
RuntimeDirectoryMode=0750
StateDirectory=nodedc-b2-vps/tailscale
StateDirectoryMode=0700
ExecStart=/opt/nodedc-b2-vps/runtime/tailscale/tailscaled --state=/var/lib/nodedc-b2-vps/tailscale/tailscaled.state --socket=/run/nodedc-b2-vps/tailscaled.sock --tun=userspace-networking --socks5-server=127.0.0.1:1055
Restart=always
RestartSec=3s
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=no
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
SystemCallArchitectures=native
MemoryMax=160M
TasksMax=96
LimitNOFILE=8192
UMask=0077

[Install]
WantedBy=multi-user.target