[Unit]
Description=Smail 超级管理员部署端重置
After=smail.service
Requisite=smail.service

[Service]
Type=oneshot
RemainAfterExit=no
User=root
Group=root
WorkingDirectory=/opt/smail
ExecStart=/opt/smail/smail-admin
Restart=no
UMask=0077
NoNewPrivileges=true
PrivateTmp=true
PrivateNetwork=true
PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
# 交互绑定显式 start 的管理员终端，不发布系统共享密码请求；新密码不回显。
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
TimeoutStartSec=330s
TimeoutStopSec=5s
# 先通知主进程取消输入并恢复终端，超时后再清理整个控制组。
KillMode=mixed