[Unit]
Description=Expire Truf Caddy admin-only denylist entries
After=docker.service
Requires=docker.service

[Service]
Type=oneshot
User=root
Group=root
ExecStart=/usr/local/sbin/truf-caddy-admin-denylist expire
NoNewPrivileges=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=strict
ReadWritePaths=/var/lib/truf-edge /etc/truf-edge/denylist
RestrictAddressFamilies=AF_UNIX
LockPersonality=true
MemoryDenyWriteExecute=true