[Unit]
Description=Cangku remote deployment enrollment broker
After=network-online.target docker.service
Wants=network-online.target

[Service]
Type=simple
User=cangku-bootstrap
Group=cangku-bootstrap
WorkingDirectory=/opt/cangku-bootstrap/app
EnvironmentFile=/etc/cangku-bootstrap/service.env
ExecStart=/opt/cangku-bootstrap/venv/bin/python /opt/cangku-bootstrap/app/bootstrap_service.py serve
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=strict
StateDirectory=cangku-bootstrap
ReadWritePaths=/var/lib/cangku-bootstrap
MemoryMax=256M
TasksMax=64
UMask=0077

[Install]
WantedBy=multi-user.target