[Unit]
Description=OAuth2-Proxy for JupyterLab
After=network.target jupyterlab.service
Requires=jupyterlab.service

[Service]
Type=simple
ExecStart=/usr/local/bin/oauth2-proxy --config={{ jupyterlab_oauth2_proxy_dir }}/oauth2-proxy.cfg

Restart=on-failure
RestartSec=5

# Security hardening
NoNewPrivileges=true
PrivateTmp=true

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=oauth2-proxy-jupyter

[Install]
WantedBy=multi-user.target