[Unit]
Description=Guanghu owner-access recovery executor
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=root
Group=root
EnvironmentFile=/etc/guanghu/secrets/lake-lamp/action-broker.env
ExecStart=/usr/bin/node /opt/guanghu/lake-lamp-authz/owner-access-broker.js
Restart=on-failure
RestartSec=3
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadOnlyPaths=/etc/guanghu/action-broker-ssh-config /etc/guanghu/secrets/lake-lamp
RuntimeDirectory=guanghu-owner-access
RuntimeDirectoryMode=0755
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
LockPersonality=true

[Install]
WantedBy=multi-user.target