[Unit]
Description=Verified application backup to rclone crypt storage
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/app-backup.sh
# Timeout sends TERM: Bash runs its recovery trap; grace time permits service restart.
TimeoutStartSec=12h
TimeoutStopSec=5min
KillMode=mixed
UMask=0077
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=6
PrivateTmp=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
Environment=LANG=C
Environment=LC_ALL=C
StandardOutput=journal
StandardError=journal