[Unit]
Description=STH Media Node
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=media-node
Group=media-node
ExecStart=/usr/local/bin/media-node run
Restart=always
RestartSec=5
Environment=MEDIA_NODE_CONFIG=/etc/media-node/config.yaml
Environment=MEDIA_NODE_DATA=/var/lib/media-node
Environment=MEDIA_NODE_CREDENTIALS=/etc/media-node/credentials/credentials.json

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/media-node
PrivateTmp=true

[Install]
WantedBy=multi-user.target