[Unit]
Description=thermal-watch — fsync'd CPU temp/fan logger for silent-freeze diagnosis
Documentation=man:hwmon
After=multi-user.target

[Service]
Type=simple
ExecStart=/usr/local/bin/thermal-watch.py
Restart=always
RestartSec=2
# keep it out of the way: lowest CPU + idle I/O priority
Nice=19
IOSchedulingClass=idle
# small hardening; it only reads sysfs and writes its own log dir
ProtectHome=yes
ProtectSystem=strict
# auto-creates and grants RW to /var/log/thermal-watch inside the sandbox
LogsDirectory=thermal-watch
NoNewPrivileges=yes

[Install]
WantedBy=multi-user.target