[Unit]
Description=Hatchery subservice host
After=network-online.target
Wants=network-online.target
[Service]
# Addresses, paths and secrets come from the operator's environment file:
# HATCHERY_SERVER_DATA_DIR, HATCHERY_SERVER_CONTROL_TOKEN, HATCHERY_HARNESS_BIN,
# HATCHERY_HARNESS_ARGS, the name of the m4a master-key variable, and the tokens
# the harness reads. The unit contains no address and no secret.
EnvironmentFile=/etc/hatchery/server.env
ExecStart=/usr/local/bin/hatchery-server
User=hatchery
Restart=on-failure
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/hatchery
[Install]
WantedBy=multi-user.target