[Unit]
Description=Publish sanitized Guanghu persona history watermarks
After=network-online.target guanghu-persona-history-recovery.service
Wants=network-online.target

[Service]
Type=oneshot
User=guanghu-history-publisher
Group=guanghu-history-publisher
Environment=PYTHONDONTWRITEBYTECODE=1
ExecStart=/opt/guanghu/persona-history/current/guanghu_history_publisher.py --config /etc/guanghu/persona-history-publisher.json
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=6
NoNewPrivileges=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=strict
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryMax=256M
CPUQuota=30%
ReadOnlyPaths=/etc/guanghu/persona-history-publisher.token
ReadWritePaths=/var/lib/guanghu/persona-history-publisher