# /etc/systemd/system/shire-scanforge-workspace.service
[Unit]
Description=SHiRE ScanForge Private Embedded Workspace
After=network.target shire-agent@scanforge.service
Requires=shire-agent@scanforge.service

[Service]
Type=simple
User=ray
Group=ray
WorkingDirectory=/home/shire3d/ARMOR
EnvironmentFile=/etc/shire-agents/scanforge-workspace.env
Environment=SHIRE_SCANFORGE_STATIC_ROOT=/home/shire3d/ARMOR/agents/apps/scanforge/dist/shire-module
Environment=SHIRE_SCANFORGE_DATA_ROOT=/home/shire3d/ARMOR/data/agents/scanforge/workspace
Environment=SHIRE_SCANFORGE_RUNTIME_BASE=http://127.0.0.1:8784
ExecStart=/usr/bin/python3 /home/shire3d/ARMOR/agents/runtime/scanforge_workspace_gateway.py --host 127.0.0.1 --port 8785
Restart=on-failure
RestartSec=2
UMask=0077
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=false
RestrictSUIDSGID=true
LockPersonality=true
ReadWritePaths=/home/shire3d/ARMOR/data/agents/scanforge/workspace

[Install]
WantedBy=multi-user.target