[Unit]
Description=mc-proxy database backup
After=mc-proxy.service

[Service]
Type=oneshot
User=mc-proxy
Group=mc-proxy
ExecStart=/usr/local/bin/mc-proxy snapshot --config /srv/mc-proxy/mc-proxy.toml
ExecStartPost=/usr/bin/find /srv/mc-proxy/backups -name "mc-proxy-*.db" -type f -mtime +30 -delete

NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictNamespaces=true
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictRealtime=true
ReadWritePaths=/srv/mc-proxy