From 4bcb92415878e75409d28327172ba7bb1ae03421 Mon Sep 17 00:00:00 2001
From: Tyler <tyler@dinsmoor.us>
Date: Thu, 22 Oct 2026 23:50:02 -0700
Subject: [PATCH] harden kjv service

---
 install/kjv-api.service | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/install/kjv-api.service b/install/kjv-api.service
index 7ef7c91..1c9f3ec 100644
--- a/install/kjv-api.service
+++ b/install/kjv-api.service
@@ -7,6 +7,12 @@ ExecStart=/opt/kjv-api/kjv-api.sh
 User=kjv
 EnvironmentFile=/etc/environment
 KillMode=mixed
+# Hardening: the app may only write to its databases and logs, never its own code
+NoNewPrivileges=yes
+ProtectSystem=strict
+ReadWritePaths=/opt/kjv-api/data /opt/kjv-api/logs
+ProtectHome=yes
+PrivateTmp=yes
 
 [Install]
 WantedBy=multi-user.target