Dear Maintainer,

In order to help secure running instances of luanti Debian should provide a default apparmor profile. I considered applying this upstream however it seems upstream does not even provide their own starter systemd service files.

I've attached the apparmor profile I've been using for a few months. It assumes Bug#1121644 is completed (it supports /usr/local).

In my opinion this should be enabled by default to help secure systems but I am unsure what Debian's policy is on that.

```
# AppArmor profile for luantiserver

#include <tunables/global>

profile luantiserver /usr/libexec/luanti/luantiserver {
  #include <abstractions/base>
  #include <abstractions/nameservice>
  #include <abstractions/openssl>
  #include <abstractions/user-tmp>

  # Network access
  network inet stream,
  network inet dgram,
  network inet6 stream,
  network inet6 dgram,

  # Capabilities
  capability setuid,
  capability setgid,
  capability net_bind_service,

  # Configuration files (read-only)
  /etc/luanti/** r,

  # Luanti data directories
  /usr/{,local/}share/luanti/** r,

  # Server data directories
  /var/lib/{,private/}luanti/** rwk,

  # Log files
  /var/log/{,private/}luanti/** rw,

  # read-only system metadata paths
  @{sys}/devices/virtual/dmi/id/chassis_type r,
  @{sys}/firmware/acpi/pm_profile            r,

  # User-specific paths
  owner @{HOME}/.luanti/** rw,

  #include if exists <local/usr.libexec.luanti.luantiserver>
}
```