monerod: update systemd config

[thomasbuilds]

This pull request updates the example systemd service configuration for running monerod to simplify the setup and improve reliability. The changes focus on making the service easier to manage and more robust, especially in how it starts and interacts with the system.

Service configuration improvements:

• Changed the Type from forking to simple and removed the use of --detach and the PIDFile, so systemd manages the process directly without needing to track a separate daemonized process.
• Added Requires=network-online.target to ensure the service only starts after the network is fully online, improving startup reliability.
• Updated the ExecStart command to remove unnecessary options and add --non-interactive for better automation and compatibility with systemd.
• Removed the RuntimeDirectory directive, simplifying the configuration since the service no longer needs to manage a PID file.

[github-actions]

What	Link
🕵️‍♂️ Review	Files changed
🌐 Deploy	Preview #294

[nahuhh]

Just need to squash the commits

cc @plowsof for a second pair of eyes

[nahuhh]

Can you squash the commits and rename the commit to something like `monerod: update systemd config"

[thomasbuilds]

Can you squash the commits and rename the commit to something like `monerod: update systemd config"

Done. Out of curiosity, why don't you want to use GitHub's built-in squash and merge?

[nahuhh]

Because it modifies your commits. Maintainers on monero-project merge as-is

[thomasbuilds]

Would you be interested in hardening the daemon's systemd service?

I managed to get monerod.service down to a 1.5 OK score with systemd-analyze security
Right now it's rated UNSAFE

Adding the following worked for me without affecting node functionality in any way:

# optional hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectHostname=true
ProtectClock=true
LockPersonality=true
RestrictRealtime=true
ProtectKernelLogs=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
PrivateDevices=true
UMask=0077
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/monero
ReadOnlyPaths=/etc/monero
CapabilityBoundingSet=
RestrictNamespaces=true
ProtectProc=invisible
ProcSubset=pid
RemoveIPC=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
SystemCallFilter=@system-service ~@privileged
SystemCallErrorNumber=EPERM