[Unit]
Description=SHiRE Private Approval Hub
After=network-online.target tailscaled.service
Wants=network-online.target
Requires=tailscaled.service

[Service]
Type=simple
User=ray
Group=ray
Environment=PYTHONUNBUFFERED=1
EnvironmentFile=/etc/shire-approval-hub/approval-hub.env
ExecStart=/home/shire3d/ARMOR/venv/bin/python /usr/local/lib/shire-approval-hub/server.py
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=read-only
ReadWritePaths=/SHiREVault/SHiREApprovals /SHiREVault/SHiREMobile/Releases
ReadOnlyPaths=/SHiREVault/SHiREAcademy/Practice

[Install]
WantedBy=multi-user.target