[Unit]
Description=Read-only Basecamp MCP server
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=basecamp-mcp
Group=basecamp-mcp
WorkingDirectory=/opt/basecamp-mcp
EnvironmentFile=/opt/basecamp-mcp/.env
ExecStart=/opt/basecamp-mcp/basecamp-mcp
Restart=always
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/basecamp-mcp/data
LimitNOFILE=4096

[Install]
WantedBy=multi-user.target