[Unit]
Description=backup-master server
After=network-online.target
Wants=network-online.target

[Service]
User=backup-master
Group=backup-master
Environment=BM_LISTEN=127.0.0.1:8080
Environment=BM_DATA=/var/lib/backup-master
Environment=BM_PUBLIC_URL=https://backup.example.com
Environment=BM_DIST=/opt/backup-master/dist
Environment=BM_TRUST_PROXY=1
ExecStart=/usr/local/bin/backupctl server
Restart=on-failure
RestartSec=5

NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/backup-master

[Install]
WantedBy=multi-user.target