[Unit]
Description=Kresus service
After=network.target

[Service]
User=kresus
Group=kresus
Type=simple
Environment="NODE_ENV=production"
ExecStart=/usr/bin/kresus -c /etc/webapps/kresus/config.ini
Restart=always
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=strict
ProtectControlGroups=yes
ProtectKernelTunables=true
ProtectKernelModules=yes
ReadWritePaths=/etc/webapps/kresus/config.ini /var/lib/kresus

[Install]
WantedBy=multi-user.target
