[Unit]
Description=lchat auto-updater (one release-channel update pass)
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
# Optional override: LCHAT_UPDATE_MANIFEST_URL (point a box at another feed).
EnvironmentFile=-/data/update.env
ExecStart=/opt/lchat/lchat update run

# --- hardening (see docs/instance-router.md § Hardening) ---
# Runs as ROOT deliberately, like lchat-control: an update pass writes the
# version store (/opt/lchat) and restarts instance units via systemctl. It is
# fired by lchat-update.timer, never routed or listening. NoNewPrivileges and
# the syscall filter are omitted for the systemctl child; the rest applies.
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectClock=yes
ProtectHostname=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
MemoryMax=256M
TasksMax=64