[Unit]
Description=Claude Code Remote Control (read-only MCP servers)
Wants=network-online.target
After=network-online.target mariadb.service
# about 50 min of failed starts (back-off below): give up and notify
StartLimitIntervalSec=1h
StartLimitBurst=8
OnFailure=claude-rc-notify.service

[Service]
User=claude-rc
Group=claude-rc
WorkingDirectory=/var/lib/claude-rc/data
# strips credentials from subprocess environments; on Linux also sandboxes ! shell commands
Environment=CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1
ExecStart=/usr/bin/claude remote-control --name data --spawn session
Restart=always
RestartSec=30s
RestartSteps=4
RestartMaxDelaySec=10min
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/claude-rc
PrivateTmp=yes
NoNewPrivileges=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
ProtectKernelLogs=yes
ProtectClock=yes
ProtectHostname=yes
CapabilityBoundingSet=
RestrictSUIDSGID=yes
RestrictRealtime=yes
LockPersonality=yes
# no RestrictNamespaces/MemoryDenyWriteExecute: the Bash sandbox (bubblewrap) needs user namespaces

[Install]
WantedBy=multi-user.target