[Unit]
Description=Mission Core bounded USB startup recovery
Wants=systemd-udev-settle.service
After=systemd-udev-settle.service
Before=mission-core-node.service mission-core-vesc.service
ConditionPathExists=/etc/mission-core-node/usb-startup.json

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/python3 -I -B /usr/lib/mission-core-node/usb_startup_recovery.py
ExecStopPost=/usr/bin/python3 -I -B /usr/lib/mission-core-node/usb_startup_recovery.py --restore
TimeoutStartSec=130
TimeoutStopSec=15
RuntimeDirectory=mission-core-usb-startup
RuntimeDirectoryMode=0755
RuntimeDirectoryPreserve=yes
UMask=0077
NoNewPrivileges=yes
PrivateNetwork=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK
CapabilityBoundingSet=
ReadWritePaths=/sys/devices /run/mission-core-usb-startup
DevicePolicy=closed
DeviceAllow=char-usb_device rw
TasksMax=16
MemoryMax=64M

[Install]
WantedBy=multi-user.target