[Unit]
Description=Mission Core Insta360 model broker
ConditionPathExists=/var/lib/mission-core-insta360/active.path
[Service]
Type=simple
User=mission-core-insta360
Group=mission-core-node
ExecStart=/usr/bin/python3 -I /usr/lib/mission-core-node/insta360/bootstrap.py broker
RuntimeDirectory=mission-core-insta360
RuntimeDirectoryMode=0750
StateDirectory=mission-core-insta360-broker
StateDirectoryMode=0700
UMask=0007
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
CapabilityBoundingSet=
TasksMax=192
MemoryMax=1G
CPUQuota=150%
Restart=on-failure
RestartSec=3
[Install]
WantedBy=multi-user.target