[Unit]
Description=checkbot SQLite-Backup
After=local-fs.target
AssertPathExists=/etc/checkbot/checkbot.env

[Service]
Type=oneshot
User=checkbot
Group=checkbot
EnvironmentFile=/etc/checkbot/checkbot.env
ExecStart=/opt/checkbot/deploy/backup.sh
Nice=10
UMask=0077

NoNewPrivileges=yes
ProtectSystem=strict
ReadWritePaths=/var/lib/checkbot /var/backups/checkbot
ProtectHome=yes
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=yes
LockPersonality=yes
CapabilityBoundingSet=
SystemCallFilter=@system-service