[Unit]
Description=Nexus Scanner — Netzwerk-Discovery Agent
Documentation=https://it-nexus.cereda-systems.de
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=nexus-scanner
Group=nexus-scanner
ExecStart=/usr/local/bin/nexus-scanner /etc/nexus-scanner/config.yaml
Restart=on-failure
RestartSec=10
StandardOutput=journal
StandardError=journal
SyslogIdentifier=nexus-scanner

# Security hardening
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/nexus-scanner
PrivateTmp=yes
CapabilityBoundingSet=CAP_NET_RAW CAP_NET_ADMIN

[Install]
WantedBy=multi-user.target