# inbuxa Relay on a host (relay spec, RL-31). The binary lives in
# /opt/inbuxa-relay/bin, owned by the inbuxa-relay user, so an upgrade from
# inbuxa-admin can replace it (RL-29); the relay then exits, and Restart=
# starts the new one. It may bind ports 25 and 443 and nothing more.
[Unit]
Description=inbuxa Relay
Conflicts=postfix.service sendmail.service exim4.service
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/opt/inbuxa-relay/bin/inbuxa-relay run --state /var/lib/inbuxa-relay
Restart=always
RestartSec=2
SyslogIdentifier=inbuxa-relay
User=inbuxa-relay
Group=inbuxa-relay
StateDirectory=inbuxa-relay
StateDirectoryMode=0700
LimitNOFILE=65536
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
NoNewPrivileges=yes
ProtectSystem=strict
ReadWritePaths=/opt/inbuxa-relay/bin
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target