[Unit]
Description=Verified application backup to rclone crypt storage
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
# Bash is an allowed entry point for this SELinux service domain. Running rsync
# directly as the entry point can fail even when child execution is permitted.
ExecStart=/bin/bash /usr/local/sbin/app-backup.sh
# A privileged backup crosses web/mail/user labels and preserves those labels.
# Keep enforcing globally; scope unconfined execution to this backup service.
# This deliberately removes SELinux confinement for this unit and its children.
# No '-' prefix: an unavailable/denied context must fail visibly.
SELinuxContext=system_u:system_r:unconfined_service_t:s0
# Timeout sends TERM: Bash runs its recovery trap; grace time permits service restart.
TimeoutStartSec=12h
TimeoutStopSec=5min
KillMode=mixed
UMask=0077
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=6
PrivateTmp=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
Environment=LANG=C
Environment=LC_ALL=C
StandardOutput=journal
StandardError=journal