[Unit]
Description=thought stream read-only Fastmail JMAP producer
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
WorkingDirectory=%h/code/thought-stream
Environment=THOUGHTSTREAM_ROOT=%h/.local/share/thoughtstream/live
EnvironmentFile=%h/.config/thoughtstream/credentials/fastmail-jmap.env
ExecStart=%h/.nvm/versions/node/v22.19.0/bin/node --import tsx src/cli.ts fastmail-jmap --config %h/.local/share/thoughtstream/live/thoughtstream.local.yaml --source fastmail:cameron
Restart=always
RestartSec=15
TimeoutStopSec=30
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=%h/.local/share/thoughtstream/live
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
UMask=0077

[Install]
WantedBy=default.target