[Unit]
Description=Verstak Sync Server
After=network.target

[Service]
Type=simple
User=verstak
Group=verstak
WorkingDirectory=/opt/verstak-sync-server
EnvironmentFile=-/etc/verstak-server/env
ExecStart=/opt/verstak-sync-server/verstak-sync-server --data /var/lib/verstak-sync-server
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ProtectKernelTunables=true
ProtectControlGroups=true
ProtectKernelModules=true
LockPersonality=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
ReadWritePaths=/var/lib/verstak-sync-server
StateDirectory=verstak-sync-server
RuntimeDirectory=verstak-sync-server

[Install]
WantedBy=multi-user.target