[Unit]
Description=Kopia backup service
Wants=network-online.target
After=network-online.target

[Service]
User=kopia
Group=kopia

Type=oneshot

# logging
StandardOutput=journal
StandardError=journal

CapabilityBoundingSet=CAP_DAC_READ_SEARCH
AmbientCapabilities=CAP_DAC_READ_SEARCH

ProtectSystem=strict
ProtectHome=tmpfs
InaccessiblePaths=/boot /root

BindReadOnlyPaths={{ node['home_path'] }}/data

# In root namescope, %u always bring 0
BindPaths=/etc/kopia
BindPaths=/etc/secrets/{{ kopia_uid }}
BindPaths=/var/cache/kopia
EnvironmentFile=/etc/secrets/{{ kopia_uid }}/kopia.env

ExecStartPre=/usr/bin/nc -zv {{ services['kopia']['domain']['internal'] }}.{{ domain['internal'] }} 443

ExecStartPre=/usr/bin/kopia repository connect server \
    --url=https://{{ services['kopia']['domain']['internal'] }}.{{ domain['internal'] }}:443 \
    --override-username={{ node['name'] }} \
    --override-hostname={{ node['name'] }}.{{ domain['internal'] }}

ExecStart=/usr/bin/kopia snapshot create \
    {{ node['home_path'] }}/data

[Install]
WantedBy=multi-user.target