[Unit]
Description=Limristem eMail app
After=network.target mariadb.service redis-server.service nginx.service
Wants=network-online.target

[Service]
WorkingDirectory=__BASE_DIR__
EnvironmentFile=__BASE_DIR__/config/limristem-mail.env
Environment=PYTHONDONTWRITEBYTECODE=1
Environment=PYTHONUNBUFFERED=1
Environment=PYTHONPATH=__BASE_DIR__/bin
ExecStart=__BASE_DIR__/.venv/bin/python __BASE_DIR__/limristem-mail start api --host ${LIMRISTEM_MAIL_API_BIND} --port ${LIMRISTEM_MAIL_API_PORT}
Restart=on-failure
RestartSec=2
User=limristem-mail
Group=limristem-mail
# NoNewPrivileges is intentionally omitted so passwordless sudo helpers can elevate.
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
ProtectProc=invisible
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictNamespaces=yes
SystemCallArchitectures=native
# Writable only where the app or its helpers legitimately need local state.
# Service configuration under /etc is mutated exclusively via sudo helpers.
ReadWritePaths=__BASE_DIR__/config
ReadWritePaths=-/var/backups/limristem-mail
ReadWritePaths=-/var/lib/limristem-mail
ReadWritePaths=-/var/lib/limristem-mail/backup-state
ReadWritePaths=-__MAIL_HOME__
ReadWritePaths=-/etc/limristem-mail-rclone.conf

[Install]
WantedBy=multi-user.target