feat(valkey): added new basic valkey role

ansible_collections/nullified/infrastructure/roles/valkey/templates/systemd/valkey.service.j2

@@ -0,0 +1,58 @@
+[Unit]
+Description=Valey service
+Documentation=https://github.com/valkey-io/valkey-doc
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+User={{ valkey_user }}
+Group={{ valkey_group }}
+Type=notify
+UMask=0077
+ExecStart={{ valkey_binary_filepath }} {{ valkey_config_dir }}/valkey.conf
+Restart=on-failure
+RestartSec=3
+TimeoutStartSec=infinity
+TimeoutStopSec=infinity
+WorkingDirectory=~
+LimitNOFILE=10032
+
+# Security Hardening
+PrivateTmp=true
+CapabilityBoundingSet=CAP_SYS_RESOURCE
+{% if systemd_version | int >= 187 %}
+NoNewPrivileges=true
+SystemCallFilter=@system-service
+{% endif %}
+{%+ if systemd_version | int >= 209 %}SystemCallArchitectures=native{%- endif +%}
+{% if systemd_version | int >= 214 %}
+ProtectHome=true
+ProtectSystem=true
+{% endif %}
+{% if systemd_version | int >= 231 %}
+ReadOnlyPaths=/
+ReadWritePaths={{ valkey_config_dir }} {{ valkey_install_dir }}
+RestrictRealtime=true
+{% endif %}
+{% if systemd_version | int >= 232 %}
+ProtectControlGroups=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+RemoveIPC=true
+{% endif %}
+{% if systemd_version | int >= 233 %}
+MountAPIVFS=true
+RestrictNamespaces=ipc net mnt pid
+{% endif %}
+{%+ if systemd_version | int >= 235 %}LockPersonality=true{%- endif +%}
+{% if systemd_version | int >= 242 %}
+ProtectHostname=true
+RestrictSUIDSGID=true
+{% endif %}
+{%+ if systemd_version | int >= 243 %}OOMScoreAdjust=-900{%- endif +%}
+{%+ if systemd_version | int >= 244 %}ProtectKernelLogs=true{%- endif +%}
+{%+ if systemd_version | int >= 245 %}ProtectClock=true{%- endif +%}
+{%+ if systemd_version | int >= 247 %}ProtectProc=invisible{%- endif +%}
+
+[Install]
+WantedBy=multi-user.target