{ config, pkgs, ... }:

{
  systemd.services.anubis-watchdog = {
    description = "Anubis Docker logs -> AbuseIPDB watchdog";
    after = [ "network.target" "docker.service" ];
    wantedBy = [ "multi-user.target" ];

    # make docker/curl available to the unit's PATH (Nix-native)
    path = [ pkgs.docker pkgs.curl pkgs.python3 pkgs.nftables ];

    serviceConfig = {
      ExecStart = "${pkgs.python3}/bin/python3 /etc/anubis-watchdog/watchdog.py";
      Restart = "on-failure";
      RestartSec = "10";
      User = "root";
      Environment = [
        "ABUSEIPDB_KEY_FILE=/etc/anubis-watchdog/abuseipdb.key"
        "DOCKER_BIN=/run/current-system/sw/bin/docker"
        # optional: "CURL_BIN=/run/current-system/sw/bin/curl"
      ];
    };
  };
}