From b5a5858ec26ba558e6040d0e2074e0fb43e60d7e Mon Sep 17 00:00:00 2001
From: Lukas Lihotzki <lukas@lihotzki.de>
Date: Mon, 6 May 2024 14:53:04 +0200
Subject: [PATCH] Drop root privileges in systemd unit (#402)

---
 install.sh                              | 4 +++-
 resources/systemd/stalwart-mail.service | 3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/install.sh b/install.sh
index c347db31..8bc9edc8 100644
--- a/install.sh
+++ b/install.sh
@@ -115,7 +115,6 @@ main() {
     # Create service file
     say "🚀 Starting service..."
     if [ "${_os}" = "linux" ]; then
-        printf "\n[server.run-as]\nuser = \"stalwart-mail\"\ngroup = \"stalwart-mail\"\n" >> "$_dir/etc/config.toml"
         create_service_linux "$_dir"
     elif [ "${_os}" = "macos" ]; then
         create_service_macos "$_dir"
@@ -148,6 +147,9 @@ RestartSec=5
 ExecStart=__PATH__/bin/stalwart-mail --config=__PATH__/etc/config.toml
 PermissionsStartOnly=true
 SyslogIdentifier=stalwart-mail
+User=stalwart-mail
+Group=stalwart-mail
+AmbientCapabilities=CAP_NET_BIND_SERVICE
 
 [Install]
 WantedBy=multi-user.target
diff --git a/resources/systemd/stalwart-mail.service b/resources/systemd/stalwart-mail.service
index aba3658e..a4d8e552 100644
--- a/resources/systemd/stalwart-mail.service
+++ b/resources/systemd/stalwart-mail.service
@@ -14,6 +14,9 @@ RestartSec=5
 ExecStart=__PATH__/bin/stalwart-mail --config=__PATH__/etc/config.toml
 PermissionsStartOnly=true
 SyslogIdentifier=stalwart-mail
+User=stalwart-mail
+Group=stalwart-mail
+AmbientCapabilities=CAP_NET_BIND_SERVICE
 
 [Install]
 WantedBy=multi-user.target