[Unit]
Description=Nexus Network Scanner Agent
Documentation=https://it-nexus.cereda-systems.de
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/bin/nexus-scanner /etc/nexus-scanner/config.yaml
Restart=on-failure
RestartSec=10s
User=nexus-scanner
Group=nexus-scanner

# Allow raw socket access for ARP (runs as non-root).
AmbientCapabilities=CAP_NET_RAW
CapabilityBoundingSet=CAP_NET_RAW

# Hardening
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
ReadWritePaths=/var/lib/nexus-scanner

# Logging — captured by journald.
StandardOutput=journal
StandardError=journal
SyslogIdentifier=nexus-scanner

[Install]
WantedBy=multi-user.target