[Unit]
Description=Mihomo core for Clash Web
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=clashweb-mihomo
Group=clashweb-core
WorkingDirectory=/var/lib/clashweb-core
ExecStart=/usr/local/bin/mihomo -d /var/lib/clashweb-core -f /var/lib/clashweb-core/config.yaml
Restart=on-failure
RestartSec=3
UMask=0027
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/clashweb-core
DevicePolicy=closed
DeviceAllow=/dev/net/tun rw
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target