[Unit]
Description=BastionGuard Anti-Ransomware Realtime (Inotify + YARA Safe Mode)
After=network.target systemd-user-sessions.service
Requires=systemd-user-sessions.service

[Service]
Type=simple
ExecStart=/usr/bin/BastionGuard-ransomware-realtime
User=root

CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_SYS_ADMIN
AmbientCapabilities=CAP_DAC_READ_SEARCH CAP_SYS_ADMIN
NoNewPrivileges=no

ReadWritePaths=/var/log/BastionGuard

StandardOutput=journal
StandardError=journal

Restart=on-failure
RestartSec=5s
TimeoutStopSec=2s

[Install]
WantedBy=multi-user.target