[Unit]
Description=barerepo
Documentation=https://github.com/barerepo/book
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=git
Group=git
Environment=BAREREPO_CONFIG=/etc/barerepo/barerepo.toml
ExecStart=/usr/local/bin/barerepo serve
Restart=on-failure
RestartSec=2

KillSignal=SIGTERM
TimeoutStopSec=45

NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ProtectHome=yes
ReadWritePaths=/var/lib/barerepo
ProtectKernelTunables=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
LockPersonality=yes

[Install]
WantedBy=multi-user.target