# /etc/systemd/system/shire-trendscout-weekly-intelligence.service
[Unit]
Description=SHiRE TrendScout Weekly Intelligence
After=network-online.target shire-trendscout.service
Wants=network-online.target
RequiresMountsFor=/mnt/shirevault-network/SHiREVault/SHIRE3D/TrendScout

[Service]
Type=oneshot
User=ray
Group=ray
WorkingDirectory=/home/shire3d/ARMOR/agents/apps/trendscout
Environment=PYTHONDONTWRITEBYTECODE=1
ExecStart=/usr/bin/python3 /home/shire3d/ARMOR/agents/apps/trendscout/trendscout_weekly_intelligence.py --run --database /home/shire3d/ARMOR/data/agents/trendscout/runtime/trendscout.sqlite3 --config /home/shire3d/ARMOR/agents/apps/trendscout/weekly_intelligence_config.json --vault-root /SHiREVault/SHIRE3D/TrendScout
UMask=0077
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
PrivateNetwork=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/home/shire3d/ARMOR/data/agents/trendscout/runtime
ReadWritePaths=/mnt/shirevault-network/SHiREVault/SHIRE3D/TrendScout
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictRealtime=true
RestrictNamespaces=true
SystemCallArchitectures=native