[Unit]
Description=Headscale - Tailscale control server
After=network-online.target
Wants=network-online.target

[Service]
User={{ headscale_sys_user }}
Group={{ headscale_sys_group }}
ExecStart=/usr/local/bin/headscale serve -c {{ headscale_config_dir }}/config.yaml
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=5

NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectSystem=strict
ProtectControlGroups=true
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ReadWritePaths={{ headscale_data_dir }}
ReadOnlyPaths={{ headscale_config_dir }}
UMask=0027

[Install]
WantedBy=multi-user.target
