[Unit]
Description=Kidcam - Motion-activated family video streaming
Documentation=file:///opt/kidcam/Biz/Kidcam/README.md
After=network-online.target
Requires=network-online.target

[Service]
Type=simple
User=kidcam
Group=kidcam
WorkingDirectory=/opt/kidcam
EnvironmentFile=/etc/kidcam/config.env
ExecStart=/usr/bin/python3 -m Biz.Kidcam.Core
Restart=on-failure
RestartSec=10
StandardOutput=journal
StandardError=journal
SyslogIdentifier=kidcam

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/kidcam/_
DeviceAllow=/dev/video0 rw
DeviceAllow=/dev/video1 rw
SupplementaryGroups=video

[Install]
WantedBy=multi-user.target