[Unit]
Description=Corrosion Companion Agent
Documentation=https://corrosionmgmt.com
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=rust
Group=rust
WorkingDirectory=/opt/corrosion
ExecStart=/opt/corrosion/corrosion-companion-linux-amd64
Restart=on-failure
RestartSec=5
StartLimitInterval=60
StartLimitBurst=3

# Environment
EnvironmentFile=/opt/corrosion/.env

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/opt/corrosion /home/rust
ProtectHome=read-only

[Install]
WantedBy=multi-user.target