[Unit]
Description=SignalScope local syslog listener (optional — only needed for the local_syslog log source, not for Graylog MCP)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=signalscope
Group=signalscope
WorkingDirectory=/opt/signalscope
ExecStart=/opt/signalscope/.venv/bin/fgai listen-syslog \
    --host 0.0.0.0 \
    --port 5514 \
    --output /opt/signalscope/logs/fg_syslog.jsonl \
    --rotate-bytes 26214400 \
    --rotate-count 14 \
    --quiet
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/signalscope/logs
# To listen on the standard syslog port 514 instead of 5514, change --port
# above to 514 and uncomment the line below instead of running as root:
# AmbientCapabilities=CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target