[Unit]
Description=BastionGuard PAC daemon (per-user)
After=network.target

[Service]
Type=simple
ExecStart=/usr/bin/bastionguard-pacd \
  --listen 127.0.0.1 --port 8765 \
  --stub-host 127.0.0.1 --stub-port 3129 \
  --backend-host 127.0.0.1 --backend-port 3130 \
  --trigger-cmd "systemctl --user start BastionGuard-cef.service" \
  --backend-wait-ms 4000

Restart=on-failure
RestartSec=1
TimeoutStopSec=5s
KillSignal=SIGTERM
KillMode=control-group
NoNewPrivileges=true
PrivateTmp=true

# Consigliato: limita rete a localhost (se vuoi hardening)
# IPAddressDeny=any
# IPAddressAllow=localhost

[Install]
WantedBy=default.target