[Unit]
Description=SHiRE Mobile Private Command Gateway
After=network-online.target tailscaled.service ollama.service shire-brain.service
Wants=network-online.target
Requires=tailscaled.service

[Service]
Type=simple
User=ray
Group=ray
Environment=PYTHONUNBUFFERED=1
EnvironmentFile=/etc/shire-mobile-gateway/mobile-gateway.env
ExecStart=/home/shire3d/ARMOR/venv/bin/python /usr/local/lib/shire-mobile-gateway/server.py
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=read-only
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
ProtectClock=true
RestrictSUIDSGID=true
LockPersonality=true
ReadOnlyPaths=/home/shire3d/ARMOR/data/sentinel
ReadWritePaths=/home/ray/.local/share/shire-mobile-gateway

[Install]
WantedBy=multi-user.target