[Unit]
Description=Terraria server (%i)
Documentation=file://@DOCDIR@/README.md
After=network-online.target terraria@%i.socket
Wants=network-online.target
# The socket unit provides a FIFO used as the server's console (stdin).
Requires=terraria@%i.socket

[Service]
Type=simple
User=terraria
Group=terraria

# Runs as root ('+'): makes the servers' journal readable by the terraria group
ExecStartPre=+@BINDIR@/terractl journal-access
# Creates the instance directory and default configs, unpacks the server zip if needed
ExecStartPre=@BINDIR@/terractl prepare %i
# Execs the vanilla or tModLoader server depending on instance.conf
ExecStart=@BINDIR@/terractl run %i
# Sends "exit" to the console (saves the world) and waits for shutdown
ExecStop=@BINDIR@/terractl stop %i $MAINPID

StandardInput=socket
StandardOutput=journal
StandardError=journal
SyslogIdentifier=terraria-%i
# Servers log to their own journal, so the terraria group can be given access to
# it without seeing the rest of the system's logs. Read it with:
#   journalctl --namespace=terraria -u terraria@<name>
# Settings (size limits etc.): /etc/systemd/journald@terraria.conf
LogNamespace=terraria

TimeoutStartSec=10min
TimeoutStopSec=90
Restart=on-failure
RestartSec=10
UMask=0027

# Hardening. Only the instances directory is writable; server zips are read-only.
# If you move TERRARIA_BASE in /etc/default/terractl, add a drop-in
# (systemctl edit terraria@.service) with ReadWritePaths=<new location>.
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/var/lib/terraria/instances
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true

[Install]
WantedBy=multi-user.target