harden kjv service

install/kjv-api.service

@@ -7,6 +7,12 @@ ExecStart=/opt/kjv-api/kjv-api.sh
 User=kjv
 EnvironmentFile=/etc/environment
 KillMode=mixed
+# Hardening: the app may only write to its databases and logs, never its own code
+NoNewPrivileges=yes
+ProtectSystem=strict
+ReadWritePaths=/opt/kjv-api/data /opt/kjv-api/logs
+ProtectHome=yes
+PrivateTmp=yes
 
 [Install]
 WantedBy=multi-user.target