# whx relay as a systemd service (Linux). Install:
#   curl -fsSL https://webhooks.xyz/cli/install.sh | sh          # or copy whx to /usr/local/bin
#   sudo install -m 755 ~/.local/bin/whx /usr/local/bin/whx
#   sudo useradd -r -s /usr/sbin/nologin whx
#   sudo install -d -o whx -g whx -m 700 /etc/whx
#   echo 'WHX_RELAY_TOKEN=whr_…' | sudo tee /etc/whx/relay.env >/dev/null && sudo chmod 600 /etc/whx/relay.env
#   sudo cp whx-relay.service /etc/systemd/system/ && sudo systemctl enable --now whx-relay
#   curl -s 127.0.0.1:9229/healthz
[Unit]
Description=webhooks.xyz Private Relay (whx relay)
Documentation=https://webhooks.xyz/docs/relay
After=network-online.target
Wants=network-online.target

[Service]
User=whx
Group=whx
EnvironmentFile=/etc/whx/relay.env
ExecStart=/usr/local/bin/whx relay --health 127.0.0.1:9229
Restart=always
RestartSec=3
# hardening: the relay needs only outbound network and the token file
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6
CapabilityBoundingSet=
ReadOnlyPaths=/etc/whx

[Install]
WantedBy=multi-user.target