[Unit]
Description=Hermes Worker Watcher (read-only)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=root
WorkingDirectory=/opt/struktur/worker-watcher
EnvironmentFile=-/etc/hermes/worker-watcher.env
ExecStart=/opt/struktur/worker-watcher/.venv/bin/watcher --config /opt/struktur/worker-watcher/config.yaml serve
Restart=on-failure
RestartSec=5s
NoNewPrivileges=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=full
ReadWritePaths=/opt/struktur/worker-watcher/data

[Install]
WantedBy=multi-user.target