[Unit]
Description=PaperCut Mobility Print loopback IPP relay
After=network-online.target
Wants=network-online.target
StartLimitIntervalSec=60
StartLimitBurst=5

[Service]
Type=simple
# The relay reads the root-owned 0600 queue YAML from acquire_queue_info.py
# and injects its Printer JWT into the upstream IPP requests.
#
# It listens on 127.0.0.1:9123 by default.  To run unprivileged, create a
# dedicated user, chown /etc/papercut/queue.yaml to that user, and uncomment:
#User=papercut
#Group=papercut
SyslogIdentifier=papercut-ipp-relay
ExecStart=/usr/bin/python3 -I -B -u /usr/local/lib/papercut/ipp_relay.py --config /etc/papercut/queue.yaml
Restart=on-failure
RestartSec=5s
TimeoutStopSec=10s
UMask=0077

# Hardening: the relay only needs to read its config, accept loopback
# connections and make outbound TCP connections to the Mobility Print server.
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
CapabilityBoundingSet=
LockPersonality=true

[Install]
WantedBy=multi-user.target