[Unit]
Description=Vacuum Wall Management WebUI
Documentation=https://github.com/wall/vacuum-wall
After=network.target firewalld.service nginx.service dnsmasq.service
Wants=firewalld.service

[Service]
Type=simple
User=vacuum-wall
Group=vacuum-wall
WorkingDirectory=/home/wall/vacuum-wall
ExecStart=/home/wall/vacuum-wall/.venv/bin/python webui/server.py
Restart=on-failure
RestartSec=5
Environment=PATH=/usr/local/bin:/usr/bin
Environment=PYTHONUNBUFFERED=1

# Security hardening
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/home/wall/vacuum-wall/data /tmp
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
ProtectHostname=yes
RestrictSUIDSGID=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictNamespaces=yes
LockPersonality=yes
SystemCallFilter=@system-service
PrivateDevices=yes

# Network - only loopback (nginx proxies to us)
IPAddressDeny=all
IPAddressAllow=localhost

[Install]
WantedBy=multi-user.target