abi <abi/5.0>,

include <tunables/global>

profile rauthy /usr/bin/rauthy flags=(complain) {
  include <abstractions/base>
  include <abstractions/nameservice>
  include <abstractions/ssl_certs>

  network inet dgram,
  network inet6 dgram,
  network inet stream,
  network inet6 stream,

  /etc/rauthy/config.toml r,  # w to use generate-config
  /var/{,lib/{,rauthy/}} r,
  owner /var/lib/rauthy/data/ w,
  owner /var/lib/rauthy/data/** rwk,
  owner /var/lib/rauthy/tls/{,*.pem} rw,

  owner @{PROC}/@{pid}/{cgroup,mountinfo} r,

  include if exists <local/rauthy>
}
