[Unit]
Description=postern email server
After=network.target
Wants=network.target

[Service]
Type=exec
DynamicUser=yes
StateDirectory=postern
ExecStart=/usr/local/bin/postern serve
LoadCredentialEncrypted=masterkey
ConfigurationDirectory=postern

# Security hardening
NoNewPrivileges=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=yes

# Capabilities
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

# Limit resources
MemoryHigh=150M
CPUQuota=50%

[Install]
WantedBy=multi-user.target