[Unit]
Description=Verified PostgreSQL and Zabbix configuration backup
Wants=network-online.target
After=network-online.target postgresql.service
RequiresMountsFor=/backup
OnFailure=zabbix-backup-failure.service

[Service]
Type=oneshot
User=root
Group=root
UMask=0077
StateDirectory=zabbix-backup
StateDirectoryMode=0700
EnvironmentFile=/etc/zabbix-backup/backup.env
ExecStart=/usr/local/sbin/zabbix-backup.sh
TimeoutStartSec=8h
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=7
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/backup /var/log/zabbix-backup /var/lib/zabbix-backup /var/cache/restic
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true