[Unit]
Description=Refresh ReelBox catalogue metadata from the original API
Wants=network-online.target
After=network-online.target
StartLimitIntervalSec=1d
StartLimitBurst=3

[Service]
Type=oneshot
User=root
WorkingDirectory=/opt/reelbox-api
EnvironmentFile=/etc/reelbox/sync.env
Environment=PYTHONUNBUFFERED=1
ExecStart=/usr/bin/python3 -B /opt/reelbox-api/catalog_sync_runner.py
TimeoutStartSec=8h
Restart=on-failure
RestartSec=1h
StateDirectory=reelbox-sync
StateDirectoryMode=0700
UMask=0077
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictNamespaces=true
LockPersonality=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
ReadWritePaths=/var/lib/reelbox-api /var/lib/reelbox-sync
MemoryMax=512M
TasksMax=16
LimitNOFILE=512
Nice=10
IOSchedulingClass=idle
StandardOutput=journal
StandardError=journal