pkg/alertmanager: Add systemd unit

The *alertmanager.service* systemd unit allows the AlertManager to run
as a daemon process.

package/alertmanager/alertmanager.mk

@@ -19,6 +19,12 @@ define ALERTMANAGER_INSTALL_TARGET_CMDS
 	$(INSTALL) -m u=rwx,go=rx $(@D)/alertmanager $(TARGET_DIR)/usr/sbin
 endef
 
+define ALERTMANAGER_INSTALL_INIT_SYSTEMD
+	$(INSTALL) -D -m u=rw,go=r \
+		$(BR2_EXTERNAL_metricspi_PATH)/package/alertmanager/alertmanager.service \
+		$(TARGET_DIR)/usr/lib/systemd/system/alertmanager.service
+endef
+
 define ALERTMANAGER_USERS
 	alertmanager -1 alertmanager -1 * - - - Prometheus Alertmanager
 endef

package/alertmanager/alertmanager.service

@@ -0,0 +1,49 @@
+[Unit]
+Description=Prometheus AlertManager
+Documentation=https://github.com/prometheus/alertmanager/blob/main/README.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=exec
+Environment=CLUSTER_LISTEN_ADDRESS=
+Environment=WEB_LISTEN_ADDRESS=[::1]:9093
+EnvironmentFile=-/etc/sysconfig/alertmanager
+ExecStart=/usr/sbin/alertmanager \
+	--config.file=/etc/prometheus/alertmanager.yml \
+	--cluster.listen-address=${CLUSTER_LISTEN_ADDRESS} \
+	--web.listen-address=${WEB_LISTEN_ADDRESS}
+ExecReload=/bin/kill -HUP $MAINPID
+Restart=on-failure
+
+CapabilityBoundingSet=
+DeviceAllow=
+DevicePolicy=closed
+DynamicUser=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateUsers=yes
+PrivateTmp=yes
+ProcSubset=pid
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProtectSystem=strict
+RestrictAddressFamilies=AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
+UMask=0027
+
+[Install]
+WantedBy=multi-user.target