[Unit]
Description=FrameFlow verified PostgreSQL, Redis, and MinIO backup
Documentation=file:///srv/frameflow/docs/deployment.md
Requires=docker.service
After=docker.service network-online.target
Wants=network-online.target
RequiresMountsFor=/mnt/encrypted-backups
AssertPathIsMountPoint=/mnt/encrypted-backups
ConditionPathExists=/srv/frameflow/scripts/scheduled-maintenance.sh
ConditionPathExists=/etc/frameflow/backup.env

[Service]
Type=oneshot
User=frameflow
Group=frameflow
SupplementaryGroups=docker
EnvironmentFile=/etc/frameflow/backup.env
WorkingDirectory=/srv/frameflow
ExecStart=/srv/frameflow/scripts/scheduled-maintenance.sh backup
UMask=0077
TimeoutStartSec=6h
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=6
NoNewPrivileges=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=strict
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
ReadWritePaths=/mnt/encrypted-backups/frameflow /var/lib/frameflow/metrics /var/run/docker.sock