[Unit]
Description=HoloLake signed release broadcast candidate
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=hololake-release
Group=hololake-release
WorkingDirectory=/opt/guanghu/hololake-release-broadcast-candidate/current
Environment=HOLOLAKE_RELEASE_HOST=127.0.0.1
Environment=HOLOLAKE_RELEASE_PORT=3940
Environment=HOLOLAKE_RELEASE_STATE_ROOT=/var/lib/guanghu/hololake-release-broadcast
Environment=HOLOLAKE_RELEASE_ENFORCE_ROOT_OWNER=1
Environment=HOLOLAKE_RELEASE_PUBLIC_PREFIX=/hololake/releases
ExecStart=/usr/bin/node /opt/guanghu/hololake-release-broadcast-candidate/current/server.mjs
Restart=on-failure
RestartSec=5
UMask=0027
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
IPAddressDeny=any
IPAddressAllow=localhost
ReadOnlyPaths=/opt/guanghu/hololake-release-broadcast-candidate
ReadOnlyPaths=/var/lib/guanghu/hololake-release-broadcast

[Install]
WantedBy=multi-user.target