[Unit]
Description=grafana
After=network.target iptables.service
# Location of this file would be /etc/systemd/system/x.service (on redhat)

# If you enable chroot then you can not import dashboards anymore

[Service]
Type=simple
#User=myuser
#Group=myuser
WorkingDirectory=/srv/grafana
#ExecStart=bin/grafana-server --config "grafana.ini" web
ExecStart=/srv/grafana/bin/grafana-server web
Restart=always
RestartSec=1m
#Environment=USER=x HOME=/home/x
IPAccounting=yes

# Hardening
NoNewPrivileges=true
PrivateTmp=true
PrivateMounts=true
PrivateDevices=true
ProtectSystem=full
ProtectHostname=true
ProtectKernelTunables=true
ProcSubset=pid
RestrictSUIDSGID=true
PrivateUsers=true
#RootDirectory=/srv/grafana
#BindReadOnlyPaths=/etc/resolv.conf
InaccessiblePaths=/bin /boot /lib /lib64 /media /mnt /opt /root /sbin /usr /var
StandardOutput=append:/srv/grafana/stdout.log
StandardError=inherit

[Install]
WantedBy=multi-user.target