[Unit]
Description=toybox switchboard (workerd forward proxy)
Requires=toybox-switchboard.socket

[Service]
ExecStart=/opt/toybox/node_modules/workerd/bin/workerd serve --experimental /opt/toybox/switchboard.capnp -S http=3
DynamicUser=yes
# the outer fence: switchboard.capnp allows "local" for tests; deny it here
IPAddressDeny=localhost link-local multicast
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
SystemCallFilter=@system-service