[Unit]
Description=Network Device Health Check Service
After=network.target

[Service]
# Run as a specific unprivileged user
User=nobody
Group=nobody

# Path to your Python script
ExecStart=/usr/bin/python3 /usr/local/bin/wg-healthcheck.py --device wg1 --port 18081

# Restart settings
Restart=always
RestartSec=5

# Security Hardening
# Allows the script to query network state without being root
AmbientCapabilities=CAP_NET_ADMIN
NoNewPrivileges=true

# Standard isolation
ProtectSystem=full
ProtectHome=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target