[Unit]
Description=Homelab MCP server (read-only context + management)
After=network-online.target homelab-context-sync.service
Wants=network-online.target

[Service]
Type=simple
WorkingDirectory=/opt/homelab-context
Environment=HOMELAB_CONTEXT_DIR=/opt/homelab-context
Environment=HOMELAB_MCP_SSH_KEY=/etc/homelab-mcp/mcp-reader.key
Environment=HOMELAB_MCP_SSH_USER=mcp-reader
ExecStart=/opt/homelab-mcp/.venv/bin/python /opt/homelab-mcp/mcp/server.py
Restart=on-failure
RestartSec=5
# Stay confined.
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
NoNewPrivileges=true
ReadOnlyPaths=/opt/homelab-context /opt/homelab-mcp
ReadWritePaths=/var/log/homelab-mcp

[Install]
WantedBy=multi-user.target