[Unit]
Description=Dynamically Generate Message Of The Day
# running update-motd.service after cloud-final.service, which will be later in the boot process
# this is to avoid running update-motd at the same time with other services such as dnf activities in userdata scripts
Wants=network-online.target cloud-final.service
After=network-online.target cloud-final.service

[Service]
Type=oneshot
ExecStart=/usr/sbin/update-motd
# update-motd should not be considered active when its processes have exited
# timer should be able to restart update-motd even after exit
RemainAfterExit=no
PrivateTmp=yes
ProtectHostname=yes
ProtectHome=yes
ProtectClock=yes
RestrictRealtime=yes
ProtectKernelTunables=yes
PrivateDevices=yes
ProtectSystem=full
SystemCallFilter=~@reboot
PrivateUsers=yes
NoNewPrivileges=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
MemoryDenyWriteExecute=yes
RestrictNamespaces=yes
RestrictSUIDSGID=yes
LockPersonality=yes
RestrictAddressFamilies=~AF_NETLINK
RestrictAddressFamilies=~AF_PACKET
CapabilityBoundingSet=
# slightly less than default 100, as other things are likely to be more critical for application setup,
# but we don't want to starve getting out of the way
StartupCPUWeight=90
# Run with less priority than other tasks by default
CPUWeight=50
# limit to a quarter of a core
CPUQuota=25%
# On startup, limit IO, but not by heaps
StartupIOWeight=90
# Run with less priority for IO than other task
IOWeight=50

[Install]
WantedBy=multi-user.target