[Unit]
Description=Cisco Catalyst 9800 WLC health check (SNMP -> email)
Documentation=file:/opt/wlc-monitor/README.md
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
User=wlcmon
Group=wlcmon
WorkingDirectory=/opt/wlc-monitor
ExecStart=/opt/wlc-monitor/venv/bin/python /opt/wlc-monitor/wlc_monitor.py \
          --config /opt/wlc-monitor/config.ini

# Creates and owns /var/lib/wlc-monitor for the state file.
StateDirectory=wlc-monitor
StateDirectoryMode=0700
UMask=0077

# The service only needs to talk UDP/161 outbound and SMTP outbound, and to
# write one JSON file. Everything else is off.
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=true
LockPersonality=true
MemoryDenyWriteExecute=true
SystemCallArchitectures=native