[Unit]
Description=Bamboo: site agent that connects a private network to the edge
Documentation=https://git.veillax.com/Veillax/bamboo
After=network-online.target
Wants=network-online.target

[Service]
User=bamboo
Group=bamboo
EnvironmentFile=-/etc/bamboo/bamboo.env
ExecStart=/usr/local/bin/bamboo -data /var/lib/bamboo
WorkingDirectory=/var/lib/bamboo
Restart=on-failure
RestartSec=3

# It makes outbound connections only, so it needs no privileges at all.
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/var/lib/bamboo
ProtectHome=true
PrivateTmp=true
ProtectKernelTunables=true
ProtectControlGroups=true

# To list this machine's Docker containers (BAMBOO_DOCKER=1), let the service read
# the Docker socket:   sudo usermod -aG docker bamboo   then restart it.

[Install]
WantedBy=multi-user.target