1[Unit]
 2Description=postern email server
 3After=network.target
 4Wants=network.target
 5
 6[Service]
 7Type=exec
 8DynamicUser=yes
 9StateDirectory=postern
10ExecStart=/usr/local/bin/postern serve
11LoadCredentialEncrypted=masterkey
12ConfigurationDirectory=postern
13
14# Security hardening
15NoNewPrivileges=yes
16PrivateDevices=yes
17ProtectKernelTunables=yes
18ProtectKernelModules=yes
19ProtectControlGroups=yes
20RestrictAddressFamilies=AF_INET AF_INET6
21RestrictNamespaces=yes
22
23# Capabilities
24AmbientCapabilities=CAP_NET_BIND_SERVICE
25CapabilityBoundingSet=CAP_NET_BIND_SERVICE
26
27# Limit resources
28MemoryHigh=150M
29CPUQuota=50%
30
31[Install]
32WantedBy=multi-user.target