# audiopen-webhook user systemd unit — example
#
# Install to ~/.config/systemd/user/audiopen-webhook.service, then:
#   systemctl --user daemon-reload
#   systemctl --user enable --now audiopen-webhook.service
#
# Check logs:
#   journalctl --user -u audiopen-webhook.service -f
#
# The shared secret lives in ~/.config/audiopen-webhook/env (chmod 600).
# Example env file contents:
#   AUDIOPEN_WEBHOOK_SECRET=<random-32-char-string>
#   # Optional overrides:
#   # AUDIOPEN_WEBHOOK_HOST=127.0.0.1
#   # AUDIOPEN_WEBHOOK_PORT=8765
#   # COUNCIL_INBOX_RAW=/var/mnt/data/projects/council/inbox/raw

[Unit]
Description=AudioPen webhook receiver (writes to council/inbox/raw)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
EnvironmentFile=%h/.config/audiopen-webhook/env
ExecStart=/usr/bin/python3 %h/projects/council/scripts/audiopen-webhook/main.py
Restart=on-failure
RestartSec=5
# Narrow permissions:
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/var/mnt/data/projects/council/inbox/raw

[Install]
WantedBy=default.target