[Unit]
Description=NETfishing public room discovery service
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=netfishing-discovery
Group=netfishing-discovery
WorkingDirectory=/var/www/netfishing.org.discovery
EnvironmentFile=/etc/netfishing-discovery.env
ExecStart=/usr/bin/python3 -m netfishing_discovery
Restart=on-failure
RestartSec=2
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target