[Unit]
Description=FEDEO host update service
Wants=network-online.target
After=network-online.target docker.service
Requires=docker.service

[Service]
Type=simple
User=root
Group=fedeo-updater
Environment=HOME=/root
Environment=PYTHONDONTWRITEBYTECODE=1
EnvironmentFile=-/etc/fedeo/updater.env
ExecStart=/usr/bin/python3 -B /usr/local/lib/fedeo-updater/selfhost-update-service.py serve --directory @FEDEO_DIRECTORY@
Restart=on-failure
RestartSec=5s
KillMode=mixed
TimeoutStopSec=infinity
UMask=0077
RuntimeDirectory=fedeo-updater
RuntimeDirectoryMode=0750
RuntimeDirectoryPreserve=yes
NoNewPrivileges=true
ProtectSystem=full
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target