[Unit]
Description=Docker Compose Backup Daemon
After=network-online.target docker.service
Wants=network-online.target
Requires=docker.service

[Service]
Type=simple
WorkingDirectory=/opt/docker-compose-backup
ExecStart=/opt/docker-compose-backup/docker-compose-backup daemon -c /opt/docker-compose-backup/config.yaml
Restart=on-failure
RestartSec=30
TimeoutStopSec=60
KillMode=mixed
KillSignal=SIGTERM

# Security hardening
User=root
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/opt/docker-compose-backup /tmp
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictRealtime=yes

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=docker-compose-backup

[Install]
WantedBy=multi-user.target