[Unit]
Description=YAAR - YouTube Auto-Archiver and Retagger
After=network.target

[Service]
Type=simple
WorkingDirectory=/opt/yaar/web
EnvironmentFile=/etc/yaar.env
ExecStart=/opt/yaar/venv/bin/gunicorn \
    --workers 2 \
    --bind 0.0.0.0:7474 \
    --timeout 0 \
    --log-file /opt/yaar/logs/gunicorn.log \
    --access-logfile /opt/yaar/logs/access.log \
    app:app
Restart=on-failure
RestartSec=5s

# Security hardening
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ReadWritePaths=/opt/yaar /media/yaar

[Install]
WantedBy=multi-user.target