[Unit]
Description=TERA management access listeners
After=network.target
Before=tera-api.service

[Service]
Type=simple
User=tera
Group=tera
EnvironmentFile=-/etc/tera/tera-accessd.env
ExecStart=/usr/bin/tera-accessd
Restart=on-failure
RestartSec=2s
UMask=0007
RuntimeDirectory=tera-accessd
RuntimeDirectoryMode=0750
StateDirectory=tera-accessd
StateDirectoryMode=0700
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
ReadOnlyPaths=/usr/share/tera-web
ReadWritePaths=/run/tera-accessd /var/lib/tera-api/tls

[Install]
WantedBy=multi-user.target