[Unit]
StartLimitIntervalSec=0
Description=BastionGuard CEF backend proxy (sandboxed, per-user)
After=graphical-session.target
Wants=graphical-session.target

[Service]
Type=simple
ExecStart=/usr/bin/bastionguard-cef --listen 127.0.0.1 --port 3130
Restart=always
RestartSec=3s
TimeoutStopSec=5s
KillSignal=SIGTERM
KillMode=control-group
NoNewPrivileges=false
PrivateTmp=true

StandardOutput=journal
StandardError=journal

[Install]
WantedBy=default.target