[Unit]
Description=rewinged winget package source
After=network.target

[Service]
User=rewinged
Group=rewinged
ExecStart=/usr/local/bin/rewinged \
  -listen 10.0.0.20:8080 \
  -manifestPath /srv/winget/manifests \
  -autoInternalize \
  -autoInternalizePath /srv/winget/installers \
  -trustedProxies 10.0.0.10 \
  -logLevel info
Restart=on-failure
RestartSec=5

# Journalisation vers fichier, pour collecte Wazuh en JSON natif
StandardOutput=append:/var/log/rewinged/rewinged.log
StandardError=append:/var/log/rewinged/rewinged.log

# Durcissement
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
NoNewPrivileges=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
ReadOnlyPaths=/srv/winget/manifests
ReadWritePaths=/srv/winget/installers /var/log/rewinged

[Install]
WantedBy=multi-user.target