[Unit]
Description=Check that the mirror wall is still watching
Documentation=file:///usr/local/share/mirror-wall-watch/README.md
# The probe is only meaningful once nginx (or whatever fronts the service) is up.
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/bin/sh /usr/local/libexec/mirror-wall-watch.sh
EnvironmentFile=-/etc/mirror-wall-watch.env
# It only ever writes /var/lib/mirror-wall-watch; keep the rest read-only.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ProtectHome=read-only