Separate jupyterhub & chp services

Allows restarting hub for config changes without disrupting user
service!

tljh/systemd-units/jupyterhub.service

@@ -1,13 +1,22 @@
 # Template file for JupyterHub systemd service
-# Runs both JupyterHub and ConfigurableHTTPProxy
 # Uses simple string.format() for 'templating'
 [Unit]
-Wants=network-online.target
+Wants=configurable-http-proxy.service
 
 [Service]
 User=root
 Restart=always
-Environment=TLJH_INSTALL_PREFIX={install_prefix}
+# jupyterhub process should have no access to home directories
+ProtectHome=tmpfs
+# Use a persistent, permissioned state directory for db + cookie secrets
 StateDirectory=jupyterhub
 WorkingDirectory=/var/lib/jupyterhub
+# Protect bits that are normally shared across the system
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+# Source CONFIGPROXY_AUTH_TOKEN from here!
+EnvironmentFile=/etc/jupyterhub/configurable-http-proxy.secret
+Environment=TLJH_INSTALL_PREFIX={install_prefix}
 ExecStart={python_interpreter_path} -m jupyterhub.app -f {jupyterhub_config_path}