[Unit]
Description=Cards web server
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=cards
Group=cards
ExecStart=/usr/bin/cards /etc/cards/config.json
Restart=on-failure
RestartSec=5
AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=yes
ProtectSystem=full
ProtectHome=yes
PrivateTmp=yes
MemoryDenyWriteExecute=yes

[Install]
WantedBy=multi-user.target