[Unit]
Description=Freva vault server
After=network.target

[Service]
Type=simple
NoNewPrivileges=true
KillSignal=SIGTERM
ExecStartPre={{ bash_cmd }} -c "PATH={{ conda_path }}/bin:$PATH \
    {{ conda_path }}/bin/python\
    {{ conda_path }}/libexec/freva-rest-server/vault/runserver.py \
    -c {{ conda_path }}/libexec/freva-rest-server/vault/vault-server-tls.hcl"
ExecStart={{ bash_cmd }} -c "{{conda_path}}/bin/uvicorn --workers 2 --app-dir \
    {{ conda_path }}/libexec/freva-rest-server/vault \
    --host 0.0.0.0 --port 5002 runserver:app"
EnvironmentFile={{ data_dir }}/config/service.env
Restart=on-failure
Environment="PATH={{conda_path}}/bin:{{ ansible_env.PATH }}"
StandardOutput=journal
StandardError=journal
RestartSec=5
StartLimitBurst=5
UMask=007
ReadWritePaths={{conda_path }}
{% if (ansible_become == true and ansible_become_user == 'root') or ansible_user == 'root' %}
PermissionsStartOnly=false
ProtectHome=true
ProtectSystem=full
User={{uid}}
Group={{gid}}
{% endif %}
[Install]
WantedBy=multi-user.target
