[Unit]
Description=Smail 邮件服务
After=network-online.target
Wants=network-online.target
StartLimitIntervalSec=300s
StartLimitBurst=3

[Service]
Type=simple
User=smail
Group=smail
# 运行环境仅由 root 可读写的独立文件提供，避免在 unit 中混入部署环境配置。
EnvironmentFile=/etc/smail/smail.env
WorkingDirectory=/opt/smail
ExecStart=/opt/smail/smail
Restart=on-failure
RestartSec=10s
# 队列等待 25 秒、数据库等待 35 秒，另留服务与日志收尾时间。
TimeoutStopSec=90s
KillMode=control-group
OOMPolicy=stop
# 默认预算只是部署起点；上线前须核对同机服务余量并完成容量验收。
MemoryAccounting=true
MemoryHigh=384M
MemoryMax=512M
MemorySwapMax=0
CPUAccounting=true
CPUQuota=100%
TasksAccounting=true
TasksMax=256
RuntimeDirectory=smail
RuntimeDirectoryMode=0750
# 目录由 smail 进程拥有，允许主服务创建受保护的本机控制套接字。

NoNewPrivileges=true
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
PrivateTmp=true
ProtectHome=true
ProtectSystem=full
ReadWritePaths=/opt/smail/config /opt/smail/data /opt/smail/ssl /opt/smail/log -/opt/smail/plugins /run/smail

[Install]
WantedBy=multi-user.target