MINOR: systemd: Add section for SystemD sandboxing to unit file
This commit adds a warning for settings that possibly provide better
sandboxing and explains their tradeoffs.
diff --git a/contrib/systemd/haproxy.service.in b/contrib/systemd/haproxy.service.in
index 804be35..5d8eecf 100644
--- a/contrib/systemd/haproxy.service.in
+++ b/contrib/systemd/haproxy.service.in
@@ -12,5 +12,11 @@
Restart=always
Type=notify
+# The following lines leverage SystemD's sandboxing options to provide
+# defense in depth protection at the expense of restricting some flexibility
+# in your setup (e.g. placement of your configuration files) or possibly
+# reduced performance. See systemd.service(5) and systemd.exec(5) for further
+# information.
+
[Install]
WantedBy=multi-user.target