[Unit]
Description=Rizoma WebPanel
Documentation=https://rizoma.mesh
After=network-online.target docker.service
Wants=network-online.target

[Service]
Type=simple
User=webpanel
Group=webpanel
SupplementaryGroups=docker
WorkingDirectory=/opt/rizoma/webpanel
EnvironmentFile=-/etc/rizoma/webpanel.env
ExecStart=/opt/rizoma/webpanel/bin/webpanel
Restart=on-failure
RestartSec=5s
KillSignal=SIGINT
TimeoutStopSec=30s

AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
PrivateTmp=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
ProtectSystem=full
ReadWritePaths=/opt/rizoma /var/log/rizoma /var/mail/rizoma /home/ftp /run

[Install]
WantedBy=multi-user.target