[Unit]
Description=Advanced key-value store
After=network.target
Documentation=http://redis.io/documentation, man:redis-sentinel(1)

[Service]
Type={{ 'forking' if redis_daemonize == 'yes' else 'simple' }}
ExecStart={{ redis_install_dir }}/bin/redis-server /etc/redis/sentinel_{{ redis_sentinel_port }}.conf --sentinel
EnvironmentFile=-/etc/default/sentinel_{{ redis_sentinel_port }}
PIDFile={{ redis_sentinel_pidfile }}
TimeoutStopSec=0
Restart=always
User={{ redis_user }}
Group={{ redis_group }}

UMask=007
PrivateTmp=yes
LimitNOFILE={{ redis_nofile_limit }}
PrivateDevices=yes
ProtectHome=yes
ReadOnlyDirectories=/
ReadWriteDirectories=-{{ redis_sentinel_dir }}
{% if redis_sentinel_logfile != '""' %}
ReadWriteDirectories=-{{ redis_sentinel_logfile|dirname }}
{% endif %}
ReadWriteDirectories=-{{ redis_sentinel_pidfile|dirname }}
CapabilityBoundingSet=~CAP_SYS_PTRACE

# redis-sentinel writes its own config file so we allow writing there (NB.
# ProtectSystem=true over ProtectSystem=full)
ProtectSystem=true
ReadWriteDirectories=-/etc/redis

[Install]
WantedBy=multi-user.target