From d608ffeeda1a479c9dc0e5f6ad269ba07a510d7f Mon Sep 17 00:00:00 2001
From: Andrew Guschin <guschin@altlinux.org>
Date: Fri, 30 Oct 2026 03:10:41 +0400
Subject: Implement Linux proxy controller, subscription state, and CLI/TUI

---
 assets/roentgen-xray.service | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 assets/roentgen-xray.service

(limited to 'assets/roentgen-xray.service')

diff --git a/assets/roentgen-xray.service b/assets/roentgen-xray.service
new file mode 100644
index 0000000..7cbdaea
--- /dev/null
+++ b/assets/roentgen-xray.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Roentgen-owned system Xray process
+Requires=roentgen-guard.service
+After=roentgen-guard.service
+
+[Service]
+Type=simple
+User=roentgen-xray
+Group=roentgen-xray
+ExecStart=/usr/bin/xray run -config /run/roentgen/xray.json
+Restart=on-failure
+RestartSec=5
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectHome=yes
+ProtectSystem=strict
+UMask=0077
-- 
cgit v1.2.3