systemd service hardening

+ add systemd protective features to restrict the system access
+ add service documentation link
+ add service required / after fields

contrib/init/linux-systemd/ejabberd-cleanup.service

@@ -1,5 +1,7 @@
 [Unit]
 Description=Clean up ejabberd
+Documentation=https://dev.sum7.eu/sum7/ejabberd-tools/-/blob/master/README.md
+Requires=ejabberd.service
 
 [Service]
 Type=oneshot
@@ -8,6 +10,13 @@ Group=nobody
 Environment="PATH=/opt/ejabberd-tools/venv/bin:/usr/local/bin:/usr/bin:/bin"
 ExecStart=/opt/ejabberd-tools/cleanup.py
 WorkingDirectory=/opt/ejabberd-tools/
+PrivateDevices=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=yes
+ProtectSystem=full
+NoNewPrivileges=yes
 
 [Install]
 WantedBy=multi-user.target

contrib/init/linux-systemd/ejabberd-exporter.service

@@ -1,5 +1,8 @@
 [Unit]
 Description=ejabberd prometheus exporter
+Documentation=https://dev.sum7.eu/sum7/ejabberd-tools/-/blob/master/README.md
+After=prometheus.service
+Requires=ejabberd.service prometheus.service
 
 [Service]
 Type=simple
@@ -8,6 +11,13 @@ Group=nobody
 Environment="PATH=/opt/ejabberd-tools/venv/bin:/usr/local/bin:/usr/bin:/bin"
 ExecStart=/opt/ejabberd-tools/prometheus.py
 WorkingDirectory=/opt/ejabberd-tools/
+PrivateDevices=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=yes
+ProtectSystem=full
+NoNewPrivileges=yes
 Restart=always
 RestartSec=5s
 

contrib/init/linux-systemd/ejabberd-influxdb.service

@@ -1,5 +1,8 @@
 [Unit]
 Description=ejabberd influxdb exporter
+Documentation=https://dev.sum7.eu/sum7/ejabberd-tools/-/blob/master/README.md
+After=influxdb.service
+Requires=ejabberd.service influxdb.service
 
 [Service]
 Type=simple
@@ -8,6 +11,13 @@ Group=nogroup
 Environment="PATH=/opt/ejabberd-tools/venv/bin:/usr/local/bin:/usr/bin:/bin"
 ExecStart=/opt/ejabberd-tools/influx.py
 WorkingDirectory=/opt/ejabberd-tools/
+PrivateDevices=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=yes
+ProtectSystem=full
+NoNewPrivileges=yes
 Restart=always
 RestartSec=5s