[Unit]
Description=ChronoSeal Cryptographic Attestation Daemon
After=network.target
Wants=network-online.target

[Service]
Type=simple
User=chronoseal
Group=chronoseal
ExecStart=/usr/local/bin/chronoseal run
WorkingDirectory=/opt/chronoseal
Restart=always
RestartSec=3
Environment=RUST_LOG=info

# Hardening (production-grade)
ProtectSystem=strict
ProtectHome=yes
NoNewPrivileges=yes
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
SystemCallArchitectures=native
ReadWritePaths=/run/chronoseal.pid
ReadWritePaths=/var/lib/chronoseal

# Logging
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target