[Unit]
Description=PezbridgeBot - USDT bridge automation-key allowance renewal notifier (holds no key)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=pezbridgebot
Group=pezbridgebot
WorkingDirectory=/opt/pezbridgebot/data
ExecStart=/opt/pezbridgebot/bin/pezbridge-bot
Environment=PEZBRIDGE_CONFIG=/opt/pezbridgebot/bin/pezbridge_bot_config.json
Environment=RUST_LOG=info
EnvironmentFile=/etc/pezbridgebot/telegram_token.env
Restart=on-failure
RestartSec=10

# --- Hardening ---
# Deployed 2026-07-13 on NEW-10 (89.116.25.180), simplified 2026-07-14: this process used to
# also hold Noter's (Validator_04's) mnemonic via LoadCredential so it could automate 1-of-3
# required signatures. That stopped being worth the risk once pwap-web shipped a real signing
# UI (any of the 5 signers can now approve directly with their own wallet extension at
# /multisig/pending) - the bot-held key only ever saved "2 humans click instead of 3", not
# enough to justify a private key living on a server. Noter's mnemonic was removed from this
# host entirely; this unit now only reads chain state and sends Telegram messages - it has no
# LoadCredential, no signing capability, and nothing worth exfiltrating. The hardening below is
# kept anyway as good baseline practice, not because there's a key to protect anymore.
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
LockPersonality=yes
RestrictRealtime=yes
RestrictNamespaces=yes
MemoryDenyWriteExecute=yes
SystemCallFilter=@system-service
SystemCallArchitectures=native
CapabilityBoundingSet=
AmbientCapabilities=
ReadWritePaths=/opt/pezbridgebot/data
UMask=0077

[Install]
WantedBy=multi-user.target