# /etc/systemd/system/payslip-archiver.service
#
# Installed by deploy/scripts/bootstrap.sh (one-time, as root); releases are then rolled out by the
# root-owned /usr/local/sbin/payslip-archiver-install, which the Deploy workflow runs. Manual install:
#
#   sudo deploy/scripts/bootstrap.sh                                      # once per host
#   dotnet publish src/PayslipArchiver.Worker -c Release -r linux-x64 -o /tmp/payslip-release
#   cp deploy/systemd/payslip-archiver.env /tmp/payslip-archiver.env     # then fill in the secrets
#   sudo /usr/local/sbin/payslip-archiver-install /tmp/payslip-release /tmp/payslip-archiver.env
#   journalctl -u payslip-archiver -f
#
# Type=notify works because the host calls AddSystemd(). /opt/payslip-archiver/bin is a symlink to the
# current release; the ledger and the single-file extraction cache live under /var/lib/payslip-archiver.

[Unit]
Description=Payslip archiver (mailbox -> decrypt -> Dropbox)
Documentation=https://github.com/guibranco/payslip-archiver
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
NotifyAccess=all
User=payslip
Group=payslip
WorkingDirectory=/opt/payslip-archiver/bin
EnvironmentFile=/etc/payslip-archiver/env
Environment=DOTNET_ENVIRONMENT=Production
Environment=Ledger__Path=/var/lib/payslip-archiver/ledger.db
ExecStart=/opt/payslip-archiver/bin/payslip-archiver
Restart=on-failure
RestartSec=30s
TimeoutStopSec=30s
SyslogIdentifier=payslip-archiver

# Hardening. On LXC targets drop ProtectSystem=strict and PrivateTmp=true — they fail to apply there.
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictSUIDSGID=true
ReadWritePaths=/var/lib/payslip-archiver
# The single-file host extracts native libraries here on first start.
Environment=DOTNET_BUNDLE_EXTRACT_BASE_DIR=/var/lib/payslip-archiver/.net

[Install]
WantedBy=multi-user.target