[Unit]
Description=Dangerous Pi Backend Service
Documentation=https://github.com/yourusername/dangerous-pi
After=network.target
Wants=network-online.target

[Service]
Type=simple
User=pi
Group=pi
WorkingDirectory=/opt/dangerous-pi
Environment="PATH=/usr/local/bin:/usr/bin:/bin"
Environment="PYTHONUNBUFFERED=1"
EnvironmentFile=-/opt/dangerous-pi/.env

# Main service command
ExecStart=/usr/bin/python3 -m uvicorn app.backend.main:app \
    --host 0.0.0.0 \
    --port 8000 \
    --log-level info

# Restart policy
Restart=always
RestartSec=10
StartLimitBurst=5
StartLimitInterval=60

# Resource limits
LimitNOFILE=65536
MemoryMax=512M
CPUQuota=80%

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/dangerous-pi/data /opt/dangerous-pi/logs
ReadOnlyPaths=/opt/dangerous-pi

# Allow I2C and Bluetooth access
SupplementaryGroups=i2c bluetooth gpio dialout

# Graceful shutdown
TimeoutStopSec=30
KillMode=mixed
KillSignal=SIGTERM

[Install]
WantedBy=multi-user.target