[Unit]
Description=Zhulan local-only allowlisted validation executor
After=local-fs.target
Before=zhulan-remote-cell.service

[Service]
Type=simple
User=zhulan-runtime
Group=zhulan-runtime
EnvironmentFile=/etc/guanghu/zhulan-remote-cell.env
ExecStart=/usr/bin/python3 /opt/guanghu/zhulan-remote-cell/runtime/zhulan_validation_executor.py
Restart=always
RestartSec=3
UMask=0077
PrivateTmp=true
PrivateDevices=true
PrivateNetwork=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
RestrictNamespaces=user mnt pid net ipc uts
SystemCallArchitectures=native
RuntimeDirectory=guanghu/zhulan-validation
RuntimeDirectoryMode=0700
ReadOnlyPaths=/opt/guanghu/zhulan-remote-cell /etc/guanghu/zhulan-remote-cell.env
ReadOnlyPaths=/srv/guanghu/zhulan-cell/workspaces
InaccessiblePaths=/etc/guanghu/secrets
ReadOnlyPaths=/var/lib/guanghu/zhulan-remote-cell
InaccessiblePaths=/srv/guanghu/zhulan-cell/candidates

[Install]
WantedBy=multi-user.target