[Unit]
Description=TERA signed local firmware staging and validation service
After=local-fs.target
Before=tera-api.service
RequiresMountsFor=/userdata

[Service]
Type=simple
User=tera-updated
Group=tera
EnvironmentFile=-/etc/tera/tera-updated.env
ExecStart=/usr/bin/tera-updated
Restart=on-failure
RestartSec=2s
RuntimeDirectory=tera-updated
RuntimeDirectoryMode=0750
UMask=0007
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
PrivateDevices=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
RestrictAddressFamilies=AF_UNIX
RestrictSUIDSGID=true
CapabilityBoundingSet=
ReadWritePaths=/userdata/update /run/tera-updated

[Install]
WantedBy=multi-user.target