[Unit]
Description=Internet Key Exchange (IKE) Protocol Daemon for IPsec
Wants=network-online.target
After=network-online.target
Documentation=man:ipsec(8) man:pluto(8) man:ipsec.conf(5)

[Service]
Type=@SD_TYPE@
Restart=@SD_RESTART_TYPE@
# backwards compatible with plutorestartoncrash=no
#RestartPreventExitStatus=137 143 SIGTERM SIGKILL

# Set WatchdogSec to the amount of time (in seconds) that systemd will wait
# before restarting an unresponsive pluto.
# EVENT_SD_WATCHDOG updates the heartbeat every 15 seconds, recommended values
# are 60, 90, 120. WatchdogSec=0 disables the action
NotifyAccess=all
WatchdogSec=@SD_WATCHDOGSEC@

# Check configuration file
ExecStartPre=@FINALLIBEXECDIR@/addconn --config @FINALCONFFILE@ --checkconfig
# Check for kernel modules
ExecStartPre=@FINALLIBEXECDIR@/_stackmanager start
# Check for nss database status and migration
ExecStartPre=@FINALSBINDIR@/ipsec --checknss
# Check for nflog setup
ExecStartPre=@FINALSBINDIR@/ipsec --checknflog
# Start the actual IKE daemon
ExecStart=@FINALLIBEXECDIR@/pluto @SD_PLUTO_OPTIONS@ --config @FINALCONFFILE@ --nofork
ExecStop=@FINALLIBEXECDIR@/whack --shutdown
ExecStopPost=/sbin/ip xfrm policy flush
ExecStopPost=/sbin/ip xfrm state flush
ExecStopPost=@FINALSBINDIR@/ipsec --stopnflog
ExecReload=@FINALLIBEXECDIR@/whack --listen

[Install]
WantedBy=multi-user.target
