[Unit]
Description=Labfy Investigation Web local service
After=default.target

[Service]
Type=simple
EnvironmentFile=%h/.config/labfy-investigation/web.env
ExecStart=%h/.local/bin/labfy-investigation-web
Restart=on-failure
RestartSec=10
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
RestrictSUIDSGID=true
LockPersonality=true
SystemCallArchitectures=native

[Install]
WantedBy=default.target