[Unit]
Description=SHiRE Marketing Boss Instagram Token Lifecycle
After=network-online.target shire-marketing-boss.service
Wants=network-online.target
Requires=shire-marketing-boss.service

[Service]
Type=oneshot
User=ray
Group=ray
WorkingDirectory=/home/shire3d/ARMOR/agents/apps/marketing-boss/production-pipeline
Environment=NODE_ENV=production
Environment=NODE_OPTIONS=--dns-result-order=ipv4first
Environment=MARKETING_PIPELINE_DATA=/var/lib/shire/marketing-boss/production-pipeline
Environment=MARKETING_BOSS_TOKEN_FILE=/var/lib/shire/marketing-boss/private/social-oauth-tokens.enc.json
Environment=INSTAGRAM_API_VERSION=v25.0
Environment=INSTAGRAM_REFRESH_WINDOW_DAYS=10
Environment=SHIREVAULT_BACKUP_ROOT=/SHiREVault/Backup/OSBackups
LoadCredential=INSTAGRAM_APP_SECRET:/etc/shire/marketing-boss-credentials/INSTAGRAM_APP_SECRET
LoadCredential=OAUTH_TOKEN_KEY:/etc/shire/marketing-boss-credentials/OAUTH_TOKEN_KEY
ExecStart=/usr/bin/node /home/shire3d/ARMOR/agents/apps/marketing-boss/production-pipeline/token-lifecycle.js
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/var/lib/shire/marketing-boss/private /var/lib/shire/marketing-boss/production-pipeline /SHiREVault/Backup/OSBackups
ReadOnlyPaths=/home/shire3d/ARMOR/agents/apps/marketing-boss
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
LockPersonality=true
UMask=0077

[Install]
WantedBy=multi-user.target