Rclone Systemd service

rclone.service

[Unit]
Description=rclone - rsync for cloud storage
Documentation=https://rclone.org/docs/
After=network-online.target
Before=caddy.service
Wants=network-online.target systemd-networkd-wait-online.service
Requires=caddy.service

[Service]
Restart=on-abnormal

; User and group the process will run as.
User=rclone
Group=rclone

EnvironmentFile=/etc/rclone/rclone-pw.txt
ExecStart=/usr/local/bin/rclone --config /etc/rclone/rclone.conf serve restic --addr 127.0.0.1:8080 --append-only --htpasswd /etc/rclone/htpasswd restic:/Volumes/storage/matt/backup/repos/shared
ExecReload=/bin/kill -USR1 $MAINPID

; Use graceful shutdown with a reasonable timeout
KillMode=mixed
KillSignal=SIGTERM
TimeoutStopSec=5s

; Limit the number of file descriptors; see `man systemd.exec` for more limit settings.
LimitNOFILE=1048576
LimitNPROC=512

; Use private /tmp and /var/tmp, which are discarded after rclone stops.
PrivateTmp=true
; Use a minimal /dev (May bring additional security if switched to 'true', but it may not work on Raspberry Pi's or other devices, so it has been disabled in this dist.)
PrivateDevices=true
; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
ProtectHome=true
; Make /usr, /boot, /etc and possibly some more folders read-only.
ProtectSystem=full
; … except /root/backup/restic/repos/, because we want to backup there.
;   This merely retains r/w access rights, it does not add any new. Must still be writable on the host!
ReadWriteDirectories=/Volumes/storage/matt/backup/repos/shared/
ReadWriteDirectories=/etc/rclone/

; The following additional security directives only work with systemd v229 or later.
; They further restrict privileges that can be gained by caddy. Uncomment if you like.
; Note that you may have to add capabilities required by any plugins in use.
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target