[Unit]
Description=Overdeck seat proxy for %i
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=overdeck-seat-proxy
Group=overdeck-seat-proxy
EnvironmentFile=/var/lib/overdeck/seat-proxy/%i/seat-proxy.env
NetworkNamespacePath=/var/run/netns/overdeck-seat-%i
ExecStartPre=+/usr/local/bin/overdeck-seat-proxy-validate %i
ExecStart=/usr/local/bin/claude-code-proxy serve --no-monitor
Restart=on-failure
RestartSec=2
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
SystemCallArchitectures=native
ReadWritePaths=/var/lib/overdeck/seat-proxy/%i
BindReadOnlyPaths=/usr/local/bin/claude-code-proxy
UMask=0077

[Install]
WantedBy=multi-user.target