[Unit]
Description=Curator cover image refresh
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
WorkingDirectory=/home/claw/pi-workspaces/curator
Environment=PYTHONPATH=/home/claw/pi-workspaces/curator
EnvironmentFile=/home/claw/.config/curator/curator.env
ExecStart=/usr/bin/python3 -m curator refresh-covers
# Network-bound and safe to fail. A stall here used to delay the backup, which
# shared the same oneshot unit and ran first.
TimeoutStartSec=30m

ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/home/claw/.local/share/curator
PrivateTmp=true
UMask=0077
NoNewPrivileges=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
RestrictNamespaces=true
LockPersonality=true
MemoryMax=1G
TasksMax=64