[Unit]
Description=MoShiro probe (network line quality measurement origin)
After=network-online.target
Wants=network-online.target

[Service]
Type=exec
User=moshiro
Group=moshiro
ExecStart=/usr/lib/moshiro/moshiro-probe --config /etc/moshiro/probe.json
Restart=always
RestartSec=5

# The probe is a pure collector: it never starts processes and writes no measurement data.
# The only file the probe writes is agents.json (the latest agent list) next to probe.json.
ReadWritePaths=/etc/moshiro
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
LockPersonality=yes
# NativeAOT does not JIT, so writable+executable memory is never needed.
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
# No capabilities needed: the probe only dials out.
CapabilityBoundingSet=

MemoryMax=64M
TasksMax=64
LimitNOFILE=4096

[Install]
WantedBy=multi-user.target