[Unit]
Description=Scert-admin 临时密码重置入口激活器
Documentation=file:///scert/docs/Scert-admin-service-management.md
After=network-online.target
Wants=network-online.target
ConditionPathExists=/scert/conf/scert.json

[Service]
Type=simple
User=Scert
Group=Scert
WorkingDirectory=/scert
RuntimeDirectory=scert-admin
RuntimeDirectoryMode=0700
ExecStart=/scert/scert-admin --config /scert/conf/scert.json --code-output /run/scert-admin/reset-code
KillSignal=SIGTERM
TimeoutStopSec=15
Restart=no
RuntimeMaxSec=30min
UMask=0077
NoNewPrivileges=yes
CapabilityBoundingSet=
AmbientCapabilities=
PrivateTmp=yes
PrivateDevices=yes
PrivateNetwork=yes
ProtectHome=yes
ProtectSystem=strict
ProtectHostname=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
ProtectKernelLogs=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
SystemCallArchitectures=native
ReadWritePaths=/scert/data /scert/log /run/scert-admin
RestrictAddressFamilies=AF_UNIX

# Scert-admin 不监听任何 TCP/UDP 端口，只维护主服务 /reset 路径的短时激活租约。
# 刻意不提供 [Install] 段，禁止通过 systemctl enable 纳入开机启动。
# 不配置 ExecReload，reload 不属于受支持的控制操作。