# {{ ansible_managed | default('Managed by Ansible') }}
# Fluent Bit systemd unit — overrides the packaged unit to add
# AmbientCapabilities for privileged-port binding and credential env vars.

[Unit]
Description=Fluent Bit syslog collector
Documentation=https://docs.fluentbit.io/
After=network-online.target opensearch.service
Wants=network-online.target
Requires=opensearch.service

[Service]
Type=simple
User={{ fluentbit_user }}
Group={{ fluentbit_group }}

Environment=FLUENTBIT_OPENSEARCH_USER={{ fluentbit_opensearch_user }}
Environment=FLUENTBIT_OPENSEARCH_PASSWORD={{ fluentbit_opensearch_password }}

ExecStart=/opt/fluent-bit/bin/fluent-bit \
  --config={{ fluentbit_config_dir }}/fluent-bit.conf

Restart=on-failure
RestartSec=5
LimitNOFILE=65536

# Bind to privileged port 514 without running as root
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

NoNewPrivileges=true
ProtectHome=true
ProtectSystem=full
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
PrivateTmp=true
ReadWritePaths={{ fluentbit_log_dir }}

[Install]
WantedBy=multi-user.target