[Unit]
Description=TERA authoritative bounded log service
After=userdata.mount
Requires=userdata.mount
Before=tera-api.service

[Service]
Type=simple
User=tera-logd
Group=tera
SupplementaryGroups=tera-logd
EnvironmentFile=-/etc/tera/tera-logd.env
ExecStart=/usr/bin/tera-logd
Restart=on-failure
RestartSec=2s
UMask=0007
RuntimeDirectory=tera-logd
RuntimeDirectoryMode=0750
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
RestrictAddressFamilies=AF_UNIX
RestrictSUIDSGID=true
ReadWritePaths=/userdata/log /run/tera-logd

[Install]
WantedBy=multi-user.target