[Unit]
Description=Alertmanager Service
After=network.target
Documentation="https://prometheus.io/docs/alerting/latest/alertmanager/"

[Service]
User={{ alertmanager_user }}
Group={{ alertmanager_group }}
Type=simple
ExecStart=/usr/local/bin/alertmanager \
          --config.file={{ alertmanager_config_dir }}/alertmanager.yml \
          --storage.path={{ alertmanager_storage_dir }}
Restart=on-failure
 
# Security hardening
ReadWritePaths={{ alertmanager_storage_dir }}
ProtectSystem=strict
NoNewPrivileges=true
PrivateTmp=true
ProtectKernelModules=true
ProtectControlGroups=true
ProtectKernelTunables=true
ProtectClock=yes
RestrictSUIDSGID=true

[Install]
WantedBy=multi-user.target