[Unit]
Description=Post76 encrypted backup in the agreed maintenance window
After=docker.service network-online.target
Wants=network-online.target
Requires=docker.service

[Service]
Type=oneshot
User=post76
Group=post76
SupplementaryGroups=docker
WorkingDirectory=/srv/post76
EnvironmentFile=/etc/post76/operations.env
UMask=0077
ExecStart=/usr/bin/python3 /srv/post76/ops/backup.py --project ${POST76_PROJECT} --env-file ${POST76_ENV_FILE} --work-dir ${POST76_WORK_DIR} $POST76_COMPOSE_FLAGS backup --quiesce
TimeoutStartSec=8h
TimeoutStopSec=4min
KillSignal=SIGTERM
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/srv/post76/ops/workspace