open-meteo-exporter.service

[Unit]
Description=Open-Meteo Exporter
After=network-online.target

[Service]
ExecStart=/home/%u/.local/bin/open_meteo_exporter.sh
LoadCredential=creds:/home/%u/.config/open_meteo_exporter.conf
Type=oneshot

# Security hardening options
DevicePolicy=closed
KeyringMode=private
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateTmp=yes
PrivateUsers=yes
ProtectSystem=strict
ProtectHome=read-only
ProtectHostname=yes
ProtectKernelLogs=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallFilter=~@cpu-emulation @debug @module
SystemCallFilter=~@mount @obsolete @privileged @raw-io @reboot @resources @swap