[Unit]
Description=Limristem eMail app
After=network.target mariadb.service redis-server.service nginx.service
Wants=network-online.target

[Service]
WorkingDirectory=__BASE_DIR__
EnvironmentFile=__BASE_DIR__/config/limristem-mail.env
Environment=PYTHONDONTWRITEBYTECODE=1
Environment=PYTHONUNBUFFERED=1
Environment=PYTHONPATH=__BASE_DIR__/bin
ExecStart=__BASE_DIR__/.venv/bin/python __BASE_DIR__/limristem-mail start api --host ${LIMRISTEM_MAIL_API_BIND} --port ${LIMRISTEM_MAIL_API_PORT}
Restart=on-failure
RestartSec=2
User=limristem-mail
Group=limristem-mail
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
LockPersonality=yes
ReadWritePaths=__BASE_DIR__/config
ReadWritePaths=-/etc/systemd/system
ReadWritePaths=-/etc/limristem-mail-rclone.conf
ReadWritePaths=-/var/backups/limristem-mail
ReadWritePaths=-/var/lib/limristem-mail/backup-state
ReadWritePaths=-/etc/nftables.conf
ReadWritePaths=-/etc/nftables.d
ReadWritePaths=-/etc/fail2ban
ReadWritePaths=-/run/fail2ban
ReadWritePaths=-/var/lib/fail2ban
ReadWritePaths=-/etc/postfix
ReadWritePaths=-/etc/dovecot
ReadWritePaths=-/etc/rspamd
ReadWritePaths=-/etc/nginx
ReadWritePaths=-/etc/ssl/limristem-mail
ReadWritePaths=-/etc/letsencrypt
ReadWritePaths=-/var/lib/letsencrypt
ReadWritePaths=-/var/log/letsencrypt
ReadWritePaths=__DKIM_KEYS_DIR__

[Install]
WantedBy=multi-user.target