[Unit]
Description=Curator database backup and retention

[Service]
Type=oneshot
WorkingDirectory=/home/claw/pi-workspaces/curator
Environment=PYTHONPATH=/home/claw/pi-workspaces/curator
EnvironmentFile=/home/claw/.config/curator/curator.env
ExecStart=/usr/bin/python3 -m curator backup
TimeoutStartSec=15m

# Local disk only; no network is needed, so egress stays closed.
IPAddressDeny=any

ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/home/claw/.local/share/curator
ReadWritePaths=/mnt/truenas/multimedia/curator
PrivateTmp=true
UMask=0077
NoNewPrivileges=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
RestrictNamespaces=true
LockPersonality=true
MemoryMax=1G
TasksMax=64