# /etc/systemd/system/shire-trendscout.service
[Unit]
Description=SHiRE TrendScout Native Read-Only Workspace
After=network-online.target shire-agent-hub.service
Wants=network-online.target

[Service]
Type=simple
User=ray
Group=ray
WorkingDirectory=/home/shire3d/ARMOR/agents/apps/trendscout
Environment=PYTHONDONTWRITEBYTECODE=1
Environment=SHIRE_ROOT=/home/shire3d/ARMOR
Environment=TRENDSCOUT_DATABASE=/home/shire3d/ARMOR/data/agents/trendscout/runtime/trendscout.sqlite3
Environment=TRENDSCOUT_STATE=/home/shire3d/ARMOR/data/agents/trendscout/state.json
Environment=TRENDSCOUT_HOST=127.0.0.1
Environment=TRENDSCOUT_PORT=8781
ExecStart=/usr/bin/python3 /home/shire3d/ARMOR/agents/apps/trendscout/trendscout_api.py --host 127.0.0.1 --port 8781
Restart=on-failure
RestartSec=3
UMask=0077
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=read-only
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/shire-trendscout-tailnet.socket
[Unit]
Description=Private Tailnet socket for SHiRE TrendScout
Requires=shire-trendscout.service
After=shire-trendscout.service

[Socket]
ListenStream=100.116.93.90:8781
NoDelay=true

[Install]
WantedBy=sockets.target

# /etc/systemd/system/shire-trendscout-tailnet.service
[Unit]
Description=Private Tailnet proxy for SHiRE TrendScout
Requires=shire-trendscout.service
After=shire-trendscout.service

[Service]
Type=notify
ExecStart=/usr/lib/systemd/systemd-socket-proxyd 127.0.0.1:8781
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6