[Unit]
Description=BastionGuard Anti-Ransomware Realtime (Inotify + YARA Safe Mode)
Documentation=https://calogeroscarna.it

# Il demone ha solo bisogno che la rete localhost sia su
After=network.target systemd-user-sessions.service
Requires=systemd-user-sessions.service

[Service]
Type=simple
ExecStart=/usr/bin/BastionGuard-ransomware-realtime

# Il demone DEVE girare come root
User=root

# Accesso ai file, inclusi /etc/BastionGuard/ransomware.token
CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_SYS_ADMIN
AmbientCapabilities=CAP_DAC_READ_SEARCH CAP_SYS_ADMIN
NoNewPrivileges=yes

# Uniche directory in scrittura richieste
ReadWritePaths=/var/log/BastionGuard

# Log nel journal
StandardOutput=journal
StandardError=journal

# Restart policy
Restart=on-failure
RestartSec=5s
TimeoutStopSec=2s

[Install]
WantedBy=multi-user.target