1[Unit]
 2Description=postern email server
 3After=network.target
 4Wants=network.target
 5
 6[Service]
 7Type=exec
 8DynamicUser=yes
 9StateDirectory=postern
10RuntimeDirectory=postern
11RuntimeDirectoryMode=0700
12ExecStart=/usr/local/bin/postern serve
13LoadCredentialEncrypted=masterkey
14ConfigurationDirectory=postern
15
16# Security hardening
17NoNewPrivileges=yes
18PrivateDevices=yes
19ProtectKernelTunables=yes
20ProtectKernelModules=yes
21ProtectControlGroups=yes
22RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
23RestrictNamespaces=yes
24
25# Capabilities
26AmbientCapabilities=CAP_NET_BIND_SERVICE
27CapabilityBoundingSet=CAP_NET_BIND_SERVICE
28
29# Limit resources
30MemoryHigh=150M
31CPUQuota=50%
32
33[Install]
34WantedBy=multi-user.target