[Unit]
Description=SkyView Database Update
Documentation=man:skyview-data(1)
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
User=skyview-adsb
Group=skyview-adsb
ExecStart=/usr/bin/skyview-data -config /etc/skyview-adsb/config.json update
StandardOutput=journal
StandardError=journal

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/skyview-adsb /tmp
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=true
RestrictSUIDSGID=true

# Resource limits
MemoryMax=256M
TasksMax=50
TimeoutStartSec=300

[Install]
WantedBy=multi-user.target