[Unit]
Description=Docker Compose Backup Daemon
After=network-online.target docker.service
Wants=network-online.target
Requires=docker.service

[Service]
Type=simple
WorkingDirectory=/opt/docker-compose-backup
ExecStart=/opt/docker-compose-backup/docker-compose-backup daemon -c /opt/docker-compose-backup/config.yaml
Restart=on-failure
RestartSec=30
TimeoutStopSec=60
KillMode=mixed
KillSignal=SIGTERM

# Security hardening
User=root
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
# The backup copies whole project directories into a staging area before
# compressing. Keep staging inside the writable install dir (see temp_dir in
# config.yaml) rather than /tmp, and do NOT use PrivateTmp — a private /tmp is
# often small/tmpfs-backed and can be exhausted by large project copies.
ReadWritePaths=/opt/docker-compose-backup
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictRealtime=yes

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=docker-compose-backup

[Install]
WantedBy=multi-user.target