[Unit]
Description=ReelBox read-only offline Catalogue API
After=network.target

[Service]
Type=simple
User=www-data
Group=www-data
WorkingDirectory=/opt/reelbox-api
ExecStart=/usr/bin/python3 -B /opt/reelbox-api/catalog_api.py
Environment=REELBOX_CATALOG_DB=/var/lib/reelbox-api/catalog.sqlite
Environment=PYTHONUNBUFFERED=1
Restart=on-failure
RestartSec=3
TimeoutStartSec=120
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictNamespaces=true
LockPersonality=true
RestrictAddressFamilies=AF_INET AF_UNIX
IPAddressDeny=any
IPAddressAllow=localhost
MemoryMax=256M
TasksMax=24
LimitNOFILE=256
UMask=0077

[Install]
WantedBy=multi-user.target