# /etc/systemd/system/shire-limbforge-canvas-gateway.service
[Unit]
Description=SHiRE LimbForge and CoverCanvas Local Gateway
After=network-online.target
Wants=network-online.target
RequiresMountsFor=/SHiREVault

[Service]
Type=simple
User=ray
Group=ray
WorkingDirectory=/home/shire3d/ARMOR
EnvironmentFile=/etc/shire-agents/limbforge-canvas-gateway.env
ExecStart=/usr/bin/python3 /home/shire3d/ARMOR/agents/runtime/limbforge_canvas_gateway.py
Restart=on-failure
RestartSec=3
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/home/shire3d/ARMOR/data/agents/limbforge-canvas /SHiREVault/SHiRELimbs
RestrictAddressFamilies=AF_UNIX AF_INET
LockPersonality=true
RestrictRealtime=true
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target