# dashboards-routectl.socket
#
# The socket the agent (and nothing else) may talk to for a route switch.
#
# 0600 + SocketUser=dashboards-agent is the whole access control at the file
# layer: only that uid can connect; everyone else gets EACCES before any code
# of ours runs. The helper's SO_PEERCRED check (its --allow-uid) is the
# *second* look, not the first.
#
# One connection, one instance: `Accept=yes` is what makes it so — the socket
# unit accepts the connection itself and hands the *connection* (not the
# listener) to a fresh `dashboards-routectl@<instance>` on stdin (StandardInput=socket);
# the instance answers one request and exits. There is no long-lived privileged
# process. (A `Service=` line naming the template does not load on systemd 257 —
# "missing the instance name" — `Accept=yes` is the documented template path.)
[Socket]
Accept=yes
ListenStream=/run/dashboards-routectl.sock
SocketUser=dashboards-agent
SocketGroup=dashboards-agent
SocketMode=0600
NoDelay=yes

[Install]
WantedBy=sockets.target