[Unit]
Description=Kezhou ICE-GL-KZ-001 daily check and Lake Heart reply
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
User=kezhou
Group=kezhou
WorkingDirectory=/opt/kezhou/agent
EnvironmentFile=-/etc/guanghu/persona-secrets/shared-deepseek.env
Environment=KEZHOU_REPO=/var/lib/guanghu/personas/kezhou/repository
Environment=KEZHOU_STATE=/var/lib/guanghu/personas/kezhou/state.json
ExecStart=/usr/bin/python3 /opt/kezhou/agent/kezhou_daily.py
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadOnlyPaths=/opt/kezhou/agent /etc/guanghu/persona-secrets
ReadWritePaths=/var/lib/guanghu/personas/kezhou

[Install]
WantedBy=multi-user.target