[Unit]
Description=Dangerous Pi Backend Service
Documentation=https://github.com/yourusername/dangerous-pi
After=network.target
Wants=network-online.target

[Service]
Type=simple
User=__DANGEROUS_PI_USER__
Group=__DANGEROUS_PI_USER__
WorkingDirectory=/opt/dangerous-pi
Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin"
Environment="PYTHONUNBUFFERED=1"
Environment="PYTHONPATH=/home/__DANGEROUS_PI_USER__/.pm3/proxmark3/client/pyscripts:/home/__DANGEROUS_PI_USER__/.pm3/proxmark3/client/experimental_lib/build"
EnvironmentFile=-/opt/dangerous-pi/.env

# Main service command
ExecStart=/usr/bin/python3 -m uvicorn app.backend.main:app \
    --host 0.0.0.0 \
    --port 8000 \
    --log-level info

# Restart policy
Restart=always
RestartSec=10
StartLimitBurst=5
StartLimitInterval=60

# Resource limits
LimitNOFILE=65536
MemoryMax=512M
CPUQuota=80%

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=read-only
ReadWritePaths=/opt/dangerous-pi/data /opt/dangerous-pi/logs /etc/NetworkManager/conf.d
ReadOnlyPaths=/opt/dangerous-pi /home/__DANGEROUS_PI_USER__/.pm3 /usr/local/bin

# Allow I2C and Bluetooth access
SupplementaryGroups=i2c bluetooth gpio dialout netdev

# Network management capabilities (for WiFi scanning/configuration without sudo)
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW

# Graceful shutdown
TimeoutStopSec=30
KillMode=mixed
KillSignal=SIGTERM

[Install]
WantedBy=multi-user.target