[Unit]
Description=PostfixAdmin-RS mail administration panel
Documentation=https://github.com/postfixadmin/postfixadmin
After=network-online.target mariadb.service mysql.service postgresql.service
Wants=network-online.target

[Service]
Type=simple
User=postfixadmin
Group=postfixadmin
WorkingDirectory=/var/lib/postfixadmin-rs
Environment=POSTFIXADMIN_RS_CONFIG=/etc/postfixadmin-rs/config.toml
EnvironmentFile=-/etc/default/postfixadmin-rs
ExecStartPre=/usr/bin/postfixadmin-rs --check-config
ExecStart=/usr/bin/postfixadmin-rs
Restart=on-failure
RestartSec=3s
UMask=0077
StateDirectory=postfixadmin-rs
StateDirectoryMode=0750

# Hardening. Hooks (doveadm, maildir scripts) run with the same restrictions;
# grant write access to additional paths with ReadWritePaths= if a hook needs it,
# e.g. ReadWritePaths=/var/lib/rspamd/dkim /etc/rspamd/local.d
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectHome=true
ProtectSystem=full
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectClock=true
ProtectHostname=true
RestrictSUIDSGID=true
RestrictNamespaces=true
RestrictRealtime=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
LockPersonality=true
MemoryDenyWriteExecute=true
CapabilityBoundingSet=
AmbientCapabilities=
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources

[Install]
WantedBy=multi-user.target