[Unit]
Description=Jumphost verschluesseltes DB-Backup

[Service]
Type=oneshot
User={{ jumphost_app_user }}
Group={{ jumphost_app_group }}
ExecStart=/usr/bin/env bash {{ jumphost_home }}/scripts/backup.sh

NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths={{ backup_dir }} {{ jumphost_data_dir }}
CapabilityBoundingSet=
UMask=0077