[Unit]
Description=defter self-hosted Zotero sync and file storage server
Documentation=https://codeberg.org/front-matter/defter
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
User=defter
Group=defter
# Settings, including where the API keys and S3 credentials are (see env.example).
EnvironmentFile=/etc/defter/env
ExecStart=/usr/local/bin/defter start
# /var/lib/defter, created and owned by the service user; defter finds it
# through $STATE_DIRECTORY without --data-dir.
StateDirectory=defter
StateDirectoryMode=0750
# With DEFTER_COMMONMETA_DB: read the commonmeta store through its group, and
# let SQLite update its -shm and -wal files beside it, which ProtectSystem=strict
# would make read-only. Check the store's path and permissions on the server
# first (docs/commonmeta-sync.md).
#SupplementaryGroups=commonmeta
#ReadWritePaths=/var/lib/commonmeta
Restart=on-failure
RestartSec=10
# Every open library holds a few files: its database, write-ahead log and
# read connections.
LimitNOFILE=65536
# Harden the service
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=true
LockPersonality=true
[Install]
WantedBy=multi-user.target