[Unit]
Description=Styrene Bond RPC Server
Documentation=https://github.com/styrene/styrene-bond-rpc
After=network.target reticulum.service
Requires=reticulum.service

[Service]
Type=simple
User=styrene
Group=styrene
WorkingDirectory=/opt/styrene-bond-rpc
ExecStart=/usr/bin/python3 -m styrene_bond_rpc.server
Restart=on-failure
RestartSec=10s
StandardOutput=journal
StandardError=journal

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/var/lib/styrene-bond-rpc
ReadWritePaths=/var/log/styrene-bond-rpc

# Resource limits
LimitNOFILE=65536
CPUQuota=50%
MemoryLimit=512M

[Install]
WantedBy=multi-user.target
