# /etc/systemd/system/shire-trendscout.service
[Unit]
Description=SHiRE TrendScout Native Read-Only Workspace
After=network-online.target shire-agent-hub.service
Wants=network-online.target

[Service]
Type=simple
User=ray
Group=ray
WorkingDirectory=/home/shire3d/ARMOR/agents/apps/trendscout
Environment=PYTHONDONTWRITEBYTECODE=1
Environment=SHIRE_ROOT=/home/shire3d/ARMOR
Environment=TRENDSCOUT_DATABASE=/home/shire3d/ARMOR/data/agents/trendscout/runtime/trendscout.sqlite3
Environment=TRENDSCOUT_STATE=/home/shire3d/ARMOR/data/agents/trendscout/state.json
Environment=TRENDSCOUT_HOST=127.0.0.1
Environment=TRENDSCOUT_PORT=8781
ExecStart=/usr/bin/python3 /home/shire3d/ARMOR/agents/apps/trendscout/trendscout_api.py --host 127.0.0.1 --port 8781
Restart=on-failure
RestartSec=3
UMask=0077
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=read-only
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6

[Install]
WantedBy=multi-user.target

# /etc/systemd/system/shire-trendscout.service.d/50-sqlite-runtime.conf
[Service]
# SQLite WAL readers require controlled access to the local -shm file.
# No other TrendScout or ARMOR directories become writable.
ReadWritePaths=/home/shire3d/ARMOR/data/agents/trendscout/runtime