[Unit]
Description=Bluebird anonymous file cabinet
After=network.target

[Service]
Type=simple
User=bluebird
Group=bluebird
WorkingDirectory=/opt/bluebird
ExecStart=/opt/bluebird/bluebird serve --config /opt/bluebird/config.toml
Restart=on-failure
RestartSec=5
TimeoutStopSec=90
UMask=0077
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/bluebird/var
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
CapabilityBoundingSet=
LockPersonality=true
MemoryMax=768M
TasksMax=256
LimitNOFILE=4096
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target