{{ ansible_managed | comment }}

[Unit]
Description=Prometheus Chrony Exporter
After=network-online.target

[Service]
Type=simple
User={{ chrony_exporter_system_user }}
Group={{ chrony_exporter_system_group }}
ExecStart={{ chrony_exporter_binary_install_dir }}/chrony_exporter \
{% for collector in chrony_exporter_enabled_collectors -%}
{%   if not collector is mapping %}
    '--collector.{{ collector }}' \
{%   else -%}
{%     set name, options = (collector.items()|list)[0] -%}
    '--collector.{{ name }}' \
{%     for k,v in options|dictsort %}
    '--collector.{{ name }}.{{ k }}={{ v }}' \
{%     endfor -%}
{%   endif -%}
{% endfor -%}
{% for collector in chrony_exporter_disabled_collectors %}
    '--no-collector.{{ collector }}' \
{% endfor %}
{% if chrony_exporter_tls_server_config | length > 0 or chrony_exporter_http_server_config | length > 0 or chrony_exporter_basic_auth_users | length > 0 %}
    '--web.config.file={{ chrony_exporter_config_dir }}/web_config.yml' \
{% endif %}
{% if chrony_exporter_version is version('0.5.0', '>=') and
      chrony_exporter_web_listen_address is iterable and
      chrony_exporter_web_listen_address is not mapping and
      chrony_exporter_web_listen_address is not string %}
{%   for address in chrony_exporter_web_listen_address %}
    '--web.listen-address={{ address }}' \
{%   endfor %}
{% else %}
    '--web.listen-address={{ chrony_exporter_web_listen_address }}' \
{% endif %}
    '--web.telemetry-path={{ chrony_exporter_web_telemetry_path }}'

SyslogIdentifier=chrony_exporter
Restart=always
RestartSec=1
StartLimitInterval=0

ProtectHome=yes
NoNewPrivileges=yes

{% if (ansible_facts.packages.systemd | first).version is version('232', '>=') %}
ProtectSystem=strict
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=yes
{% else %}
ProtectSystem=full
{% endif %}

[Install]
WantedBy=multi-user.target