[Unit]
Description=LibreTime Worker Service
PartOf=libretime.target

[Service]
NoNewPrivileges=true
CapabilityBoundingSet=
PrivateDevices=true
PrivateTmp=true
PrivateUsers=true
ProtectClock=true
ProtectControlGroups=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=full

Environment=LIBRETIME_CONFIG_FILEPATH=@@CONFIG_FILEPATH@@
Environment=LIBRETIME_LOG_FILEPATH=@@LOG_DIR@@/worker.log
WorkingDirectory=@@WORKING_DIR@@/worker

ExecStart=/usr/bin/sh -c 'celery worker \
    --app=libretime_worker.tasks:worker \
    --config=libretime_worker.config \
    --time-limit=1800 \
    --concurrency=1 \
    --loglevel=INFO \
    --logfile=$LIBRETIME_LOG_FILEPATH'
Restart=always

User=libretime
Group=libretime

[Install]
WantedBy=multi-user.target