[Unit]
Description=TERA bounded alarm delivery service
After=network-online.target
Wants=network-online.target
Before=tera-api.service

[Service]
Type=simple
User=tera
Group=tera
EnvironmentFile=-/etc/tera/tera-alarmd.env
ExecStart=/usr/bin/tera-alarmd
Restart=on-failure
RestartSec=2s
UMask=0007
StateDirectory=tera-alarmd
RuntimeDirectory=tera-alarmd
RuntimeDirectoryMode=0750
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictSUIDSGID=true
ReadWritePaths=/var/lib/tera-alarmd /run/tera-alarmd

[Install]
WantedBy=multi-user.target