[Unit]
Description=librenotes daily backup
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
EnvironmentFile=-/etc/librenotes/backup.env
ExecStart=/usr/local/bin/librenotes-backup.sh
ExecStartPost=/usr/local/bin/librenotes-backup-prune.sh
SuccessExitStatus=0
TimeoutStartSec=30min
# Backup driver only reads from the live data dir; never writes
# back. Sandbox accordingly.
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/backups/librenotes
NoNewPrivileges=true