[Unit]
Description=Limristem eMail app
After=network.target mariadb.service redis-server.service nginx.service
Wants=network-online.target

[Service]
WorkingDirectory=__BASE_DIR__
EnvironmentFile=__BASE_DIR__/config/limristem-mail.env
Environment=PYTHONDONTWRITEBYTECODE=1
Environment=PYTHONUNBUFFERED=1
Environment=PYTHONPATH=__BASE_DIR__/bin
ExecStart=__BASE_DIR__/.venv/bin/python __BASE_DIR__/limristem-mail start api --host ${LIMRISTEM_MAIL_API_BIND} --port ${LIMRISTEM_MAIL_API_PORT}
Restart=on-failure
RestartSec=2
User=limristem-mail
Group=limristem-mail
# vmail group: create Maildir trees under group-writable MAIL_HOME.
SupplementaryGroups=vmail
# Filesystem ownership changes run through manage-mailbox-fs.sh. Giving this
# process CAP_CHOWN/CAP_FOWNER would also let it take over root-owned config/.
AmbientCapabilities=
# NoNewPrivileges is intentionally omitted so passwordless sudo helpers can elevate.
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
ProtectProc=invisible
ProtectHostname=yes
ProtectClock=yes
ProtectKernelLogs=yes
# RestrictSUIDSGID is intentionally NOT set: it denies setting the setgid bit, and
# both the app and manage-mailbox-fs.sh chmod Maildir domain directories to 2770 so
# that dovecot/vmail can deliver into them.
LockPersonality=yes
RestrictRealtime=yes
RestrictNamespaces=yes
SystemCallArchitectures=native
# Nothing this service creates should be world-readable; 0007 (not 0027) because
# Maildir trees are shared with the vmail group and need group write.
UMask=0007
# SystemCallFilter is intentionally NOT set: seccomp filters are inherited by
# children, and the sudo helpers run apt/dpkg, whose maintainer scripts legitimately
# use syscalls outside @system-service. A filter here would break package updates.
# Writable only where the app or its helpers legitimately need local state.
# Service configuration under /etc is mutated exclusively via sudo helpers.
ReadWritePaths=__BASE_DIR__/config
ReadWritePaths=-/var/backups/limristem-mail
ReadWritePaths=-/var/lib/limristem-mail
ReadWritePaths=-/var/lib/limristem-mail/backup-state
ReadWritePaths=-__MAIL_HOME__
ReadWritePaths=-/etc/limristem-mail-rclone.conf
ReadWritePaths=-/var/lib/apt
ReadWritePaths=-/var/lib/dpkg
ReadWritePaths=-/var/cache/apt
ReadWritePaths=-/var/log
ReadWritePaths=-/etc/apt

[Install]
WantedBy=multi-user.target