# You should not need to edit this file. Instead, use a drop-in file as described in:
#   /usr/lib/systemd/system/@package_name@@.service.d/custom.conf

[Unit]
Description=@capbrand@ Directory Server %i.
PartOf=@systemdgroupname@
After=chronyd.service ntpd.service network-online.target systemd-tmpfiles-setup.service
Before=radiusd.service
Wants=systemd-tmpfiles-setup.service
StartLimitBurst=100

[Service]
Type=notify
NotifyAccess=all
EnvironmentFile=-@initconfigdir@/@package_name@
EnvironmentFile=-@initconfigdir@/@package_name@-%i
PIDFile=/run/@package_name@/slapd-%i.pid
ExecStartPre=@libexecdir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif
ExecStartPre=@libexecdir@/ds_selinux_restorecon.sh @instconfigdir@/slapd-%i/dse.ldif
ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i /run/@package_name@/slapd-%i.pid
PrivateTmp=on
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
ProtectSystem=full
# Protectsystem full mounts /etc ro, so we need to allow /etc/dirsrv to be writeable here.
ReadWritePaths=@instconfigdir@
ProtectHome=true
PrivateDevices=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictRealtime=true

[Install]
WantedBy=multi-user.target
