[Unit]
Description=Nextcloud to Backblaze B2 Backup
Documentation=https://backblaze.com/b2/docs/
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
User=root
WorkingDirectory=/opt/nextcloud-backup

# Environment variables - set these before deploying
EnvironmentFile=-/opt/nextcloud-backup/.env

# Load B2 credentials from secure location
EnvironmentFile=-/etc/nextcloud-backup/b2-credentials.env

# The actual backup script
ExecStart=/opt/nextcloud-backup/nextcloud-backup-to-backblaze.sh incremental

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=nextcloud-backup

# Restart on failure with exponential backoff
Restart=on-failure
RestartSec=300

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/opt/nextcloud-backup /srv/docker/nextcloud

# Resource limits
CPUQuota=80%
MemoryMax=4G
TasksMax=256