use journal namespace

systemd/terraria@.service

@@ -11,6 +11,8 @@ Type=simple
 User=terraria
 Group=terraria
 
+# Runs as root ('+'): makes the servers' journal readable by the terraria group
+ExecStartPre=+@BINDIR@/terractl journal-access
 # Creates the instance directory and default configs, unpacks the server zip if needed
 ExecStartPre=@BINDIR@/terractl prepare %i
 # Execs the vanilla or tModLoader server depending on instance.conf
@@ -22,6 +24,11 @@ StandardInput=socket
 StandardOutput=journal
 StandardError=journal
 SyslogIdentifier=terraria-%i
+# Servers log to their own journal, so the terraria group can be given access to
+# it without seeing the rest of the system's logs. Read it with:
+#   journalctl --namespace=terraria -u terraria@<name>
+# Settings (size limits etc.): /etc/systemd/journald@terraria.conf
+LogNamespace=terraria
 
 TimeoutStartSec=10min
 TimeoutStopSec=90