[Unit]
Description=NODE.DC B2 VPS encrypted private backhaul
After=network-online.target nodedc-b2-tailscaled.service
Wants=network-online.target
Requires=nodedc-b2-tailscaled.service

[Service]
Type=simple
User=nodedc-backhaul
Group=nodedc-backhaul
ExecStart=/usr/bin/ssh -N -F /opt/nodedc-b2-vps/config/backhaul_ssh_config device-backhaul-target
Restart=always
RestartSec=3s
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
MemoryMax=64M
TasksMax=32
LimitNOFILE=1024
UMask=0077

[Install]
WantedBy=multi-user.target