[Unit]
Description=Smail 超级管理员部署端重置
After=smail.service
Requisite=smail.service

[Service]
Type=oneshot
RemainAfterExit=no
User=root
Group=root
WorkingDirectory=/opt/smail
ExecStart=/opt/smail/smail-admin
Restart=no
UMask=0077
NoNewPrivileges=true
PrivateTmp=true
PrivateNetwork=true
PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
# 密码代理只在本机临时目录收集无回显输入，不允许写入业务配置或数据库。
ReadWritePaths=/run/systemd/ask-password
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
TimeoutStartSec=180s
TimeoutStopSec=5s