[Unit]
Description=RustPad collaborative notepad
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=rustpad
Group=rustpad
WorkingDirectory=/opt/rustpad
ExecStartPre=/usr/local/bin/rustpad --config /etc/rustpad/rustpad.yaml check-config
ExecStart=/usr/local/bin/rustpad --config /etc/rustpad/rustpad.yaml
Restart=on-failure
RestartSec=5s
TimeoutStopSec=30s
KillSignal=SIGTERM

StateDirectory=rustpad
StateDirectoryMode=0750
UMask=0027
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
LockPersonality=true
MemoryDenyWriteExecute=true
CapabilityBoundingSet=
AmbientCapabilities=
#ReadWritePaths=/var/lib/rustpad

[Install]
WantedBy=multi-user.target