[Unit]
Description=OSINT dashboard — masscan rolling sweep (open RTSP port 554)
Documentation=https://forgejo.siriusdevops.com/sirius/osint-dashboard
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
# masscan needs raw sockets (CAP_NET_RAW) — run as root on the Pi host.
User=root
WorkingDirectory=/opt/siriusdevops/osint-dashboard
EnvironmentFile=-/etc/osint-dashboard/masscan.env
# Point at the compose-published Postgres on the HOST (127.0.0.1:5432), not the
# docker service name 'postgres' which doesn't resolve outside the compose net.
Environment=DB_HOST=127.0.0.1
Environment=DB_PORT=5432
Environment=DB_USER=osint
Environment=DB_PASSWORD=osint
Environment=DB_NAME=osint_data
Environment=MASSCAN_EXCLUDEFILE=/etc/osint-dashboard/masscan-excludes.txt
ExecStart=/opt/siriusdevops/osint-dashboard/.venv-masscan/bin/python app/run_masscan_service.py
Restart=always
RestartSec=10
# Log the sweep to journald (read with: journalctl -u osint-masscan -f)
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target