[Unit]
Description=chan 信号搬运（把采集机的总线拉到本机）
After=network-online.target
Wants=network-online.target
StartLimitIntervalSec=300
StartLimitBurst=10

[Service]
Type=simple
User=chan
Group=chan
WorkingDirectory=/opt/chan
EnvironmentFile=/etc/chan-live/live.env
# SHIP_FROM 在 live.env 里给，形如 sg-collector 或 user@1.2.3.4
ExecStart=/opt/chan/.venv/bin/python /opt/chan/live/ship_signals.py \
    --from ${SHIP_FROM} --remote-bus ${SHIP_REMOTE_BUS}
Restart=always
RestartSec=5

StandardOutput=journal
StandardError=journal
SyslogIdentifier=chan-live-ship

NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
# chan 用户的家目录放在 /var/lib/chan-live/home，只装拉总线用的那一把 ssh
# key。这样 ProtectHome=true 挡住 /home 与 /root 的同时，ssh 仍能读到
# ~/.ssh（它在 /var/lib 下，不受 ProtectHome 影响），也能写 known_hosts
ProtectHome=true
Environment=HOME=/var/lib/chan-live/home
ReadWritePaths=/var/lib/chan-live
ProtectKernelTunables=true
ProtectKernelModules=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryMax=256M

[Install]
WantedBy=multi-user.target