# You should not need to edit this file. Instead, use a drop-in file as described in:
#   /usr/lib/systemd/system/@package_name@@.service.d/custom.conf

[Unit]
Description=@capbrand@ Directory Server %i.
PartOf=@systemdgroupname@
After=chronyd.service ntpd.service network-online.target systemd-tmpfiles-setup.service
Before=radiusd.service
Wants=systemd-tmpfiles-setup.service
StartLimitBurst=100

[Service]
Type=notify
NotifyAccess=all
EnvironmentFile=-@initconfigdir@/@package_name@
EnvironmentFile=-@initconfigdir@/@package_name@-%i
PIDFile=/run/@package_name@/slapd-%i.pid

# The =+ denotes that ExecStartPre tasks will be run with privileges in the case the instance
# is configured with a non root User/Group via an override.
# See https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html#Command%20lines
ExecStartPre=+@libexecdir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif
ExecStartPre=+@libexecdir@/ds_selinux_restorecon.sh @instconfigdir@/slapd-%i/dse.ldif
ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i /run/@package_name@/slapd-%i.pid

# Not all distributions enable the memory accounting cgroup hierachy by default. Ensure that it
# is present so that automatic database tuning works as expected
MemoryAccounting=yes

# Allow non-root instances to bind to low ports.
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER

PrivateTmp=on
# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort
ProtectSystem=full
# Protectsystem full mounts /etc ro, so we need to allow /etc/dirsrv to be writeable here.
ReadWritePaths=@instconfigdir@
ProtectHome=true
PrivateDevices=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictRealtime=true

[Install]
WantedBy=multi-user.target
