[Unit]
Description=Bichon email archiving service
After=network.target tailscaled.service
Requires=tailscaled.service

[Service]
Type=simple
User={{ bichon_sys_user }}
Group={{ bichon_sys_group }}
EnvironmentFile={{ bichon_install_dir }}/bichon.env
ExecStart={{ bichon_install_dir }}/bichon --bichon-root-dir {{ bichon_root_dir }}

Restart=on-failure
RestartSec=5
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectSystem=strict
ProtectControlGroups=true
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ReadWritePaths={{ bichon_root_dir }}
UMask=0027

[Install]
WantedBy=multi-user.target
