[Unit]
Description=Paperless consumer service
After=network.target
Requires=redis.service
PartOf=paperless.target

[Service]
User=paperless
Group=paperless
ExecStart=/var/lib/paperless/venv/bin/python manage.py document_consumer
Restart=on-abort

PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes

RestrictNamespaces=yes

SystemCallArchitectures=native
SystemCallFilter=@system-service

WorkingDirectory=/usr/share/paperless/src
ReadWriteDirectories=/var/lib/paperless /tmp /var/tmp

[Install]
WantedBy=paperless.target