[Unit]
Description=TERA privileged hardware and system control adapter
After=local-fs.target

[Service]
Type=simple
User=root
Group=tera
EnvironmentFile=-/etc/tera/tera-hwd.env
ExecStart=/usr/bin/tera-hwd
Restart=on-failure
RestartSec=2s
RuntimeDirectory=tera-hwd
RuntimeDirectoryMode=0750
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
CapabilityBoundingSet=CAP_DAC_OVERRIDE CAP_SYS_BOOT
AmbientCapabilities=CAP_DAC_OVERRIDE CAP_SYS_BOOT
ReadWritePaths=/run/tera-hwd /sys/class/leds

[Install]
WantedBy=multi-user.target