[Unit]
Description=Back up the FluxIP SQLite database
After=local-fs.target

[Service]
Type=oneshot
User=fluxip
Group=fluxip
WorkingDirectory=/opt/fluxip
ExecStart=/opt/fluxip/.venv/bin/python /opt/fluxip/deploy/backup.py --database /var/lib/fluxip/fluxip.db --output-dir /var/backups/fluxip --keep-last 30
UMask=0077

NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=strict
ReadWritePaths=/var/backups/fluxip
RestrictAddressFamilies=AF_UNIX
RestrictSUIDSGID=true
LockPersonality=true