[Unit]
Description=Caddy web server for TRI Bootstrap
After=network-online.target tor@tri-bootstrap.service
Wants=network-online.target tor@tri-bootstrap.service

[Service]
Type=simple
User=root
Group=root
ExecReload=/usr/bin/caddy reload --config /etc/caddy/tri-bootstrap-Caddyfile
ExecStart=/usr/bin/caddy run --config /etc/caddy/tri-bootstrap-Caddyfile --adapter caddyfile
Restart=on-failure
RestartSec=5

# Caddy needs to bind to ports 80 and 443
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

# Hardening
NoNewPrivileges=yes
ProtectSystem=full
ProtectHome=yes
ReadOnlyPaths=/etc/caddy/tri-bootstrap-Caddyfile
ReadWritePaths=/var/log/tri-bootstrap

[Install]
WantedBy=multi-user.target