service

# https://nileshgr.com/2016/07/09/systemd-fastcgi-multiple-processes

[Unit]
RequiresMountsFor=/var/lib/collectd/rrd

[Service]
User=www-data
Group=www-data
ExecStart=/usr/lib/cgi-bin/collection.fcgi
StandardOutput=null
StandardInput=socket
StandardError=null


# Security lockdown.
[Service]
PrivateNetwork=yes
DynamicUser=yes
User=
Group=
CapabilityBoundingSet=
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=yes
DevicePolicy=closed
IPAddressDeny=any
PrivateDevices=yes
PrivateUsers=yes
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
RestrictRealtime=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
UMask=0077
ProtectHostname=yes
ProcSubset=pid

RuntimeDirectory=collection4
WorkingDirectory=/run/collection4