[Unit]
Description=Mosquitto MQTT Broker
Documentation=man:mosquitto(8)
After=network.target

[Service]
Type=simple
ExecStart=/usr/sbin/mosquitto -c /etc/mosquitto/conf.d/mosquitto.conf
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=5
StandardOutput=journal
StandardError=journal
SyslogIdentifier=mosquitto

# Resource limits
LimitNOFILE=65535

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/log/mosquitto /var/lib/mosquitto /etc/mosquitto

[Install]
WantedBy=multi-user.target