[Unit]
Description=newsfeed model-release watcher (Hugging Face Hub -> ingest)
Documentation=https://git.lair.cafe/grenade/newsfeed
After=network-online.target newsfeed-api.service
Wants=network-online.target
# Timer-activated (see newsfeed-modelwatch.timer); no [Install] here.

[Service]
Type=oneshot
User=newsfeed
Group=newsfeed
# The ingest token (NEWSFEED_TOKEN) lives here, kept out of the deployable config so a
# redeploy of modelwatch.toml never clobbers it.
EnvironmentFile=/etc/newsfeed/modelwatch.env
ExecStart=/usr/local/bin/newsfeed-modelwatch --config /etc/newsfeed/modelwatch.toml

# Hardening (architecture generic.md §8). No DB access — this talks HTTP only, so no
# ReadWritePaths are granted.
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
SystemCallArchitectures=native
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6