[Unit]
Description=Spark MCP Go Server
After=network.target

[Service]
Type=simple
User=spark-mcp
Group=spark-mcp
WorkingDirectory=/opt/spark-mcp-go
EnvironmentFile=/opt/spark-mcp-go/.env
ExecStart=/opt/spark-mcp-go/spark-mcp-go
Restart=on-failure
RestartSec=5

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/spark-mcp-go/data

[Install]
WantedBy=multi-user.target