[Unit]
Description=Restic backup to TrueNAS
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
EnvironmentFile=/etc/restic/env
ExecStart=/usr/local/bin/restic-backup.sh

# Give restic a cache directory (avoids "no $HOME" warning)
CacheDirectory=restic
Environment=RESTIC_CACHE_DIR=/var/cache/restic

# Security hardening
PrivateTmp=true
NoNewPrivileges=true