[Unit]
Description=Home Control Service
Documentation=file:/opt/home_control/README.md
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=home-control
Group=home-control
WorkingDirectory=/opt/home_control
ExecStart=/opt/home_control/.venv/bin/python /opt/home_control/service.py --config /opt/home_control/service.yaml
Restart=on-failure
RestartSec=15s
TimeoutStopSec=20s

# The service only needs to read its application and configuration.
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
LockPersonality=true
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target