manage system access of the service using systemd

* add drone.slice (control resource usage)
* restrict can be accessed by the service
* adjust IO priority and NICEness of processes created withing the
  service
* use "-p" with docker-compose invocation to specify a project that the
  newly-spawned containers belong to (best practice)
* add commented override

drone.service

@@ -1,12 +1,47 @@
+# /etc/systemd/system/drone.service
 [Unit]
 Description=Drone server
 After=docker.service nginx.service
-OnFailure=systemd-email@%n.service
 
 [Service]
+Slice=drone.slice
+Delegate=yes
 Restart=always
-ExecStart=/usr/bin/docker-compose -f /etc/drone/docker-compose.yml up
-ExecStop=/usr/bin/docker-compose -f /etc/drone/docker-compose.yml stop
+RestartSec=5
+ExecStart=/usr/bin/docker-compose -p drone -f /etc/drone/docker-compose.yml up
+ExecStop=/usr/bin/docker-compose -p drone -f /etc/drone/docker-compose.yml stop
+
+Nice=-14
+IOSchedulingClass=1
+IOSchedulingPriority=0
+
+CapabilityBoundingSet=
+# ProtectProc=invisible
+ProtectHome=true
+RestrictNamespaces=uts ipc pid user cgroup
+NoNewPrivileges=True
+# SecureBits=noroot-locked
+ProtectSystem=strict
+PrivateTmp=true
+PrivateDevices=true
+PrivateUsers=true
+ProtectHostname=true
+ProtectClock=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+# SystemCallFilter=~memfd_create
+SystemCallArchitectures=native
 
 [Install]
 WantedBy=multi-user.target
+
+# /etc/systemd/system/drone.service.d/override.conf
+# drone service override
+# [Unit]
+# OnFailure=status_email_wanderer@%n

drone.slice

@@ -0,0 +1,14 @@
+# /etc/systemd/system/drone.slice
+[Unit]
+Description=Slice that limits drone.service resources
+Before=slices.target
+After=docker.service docker.slice
+
+[Slice]
+CPUAccounting=yes
+CPUQuota=315%
+
+MemoryAccounting=yes
+MemoryHigh=4.1G
+MemoryMax=4.2G
+MemorySwapMax=200M