[Unit]
Description=WHP locked-state unlock daemon (LUKS /docker)
Documentation=file:///root/whp/docs/LUKS_RUNBOOK.md
After=network-online.target
Wants=network-online.target
# Intentionally NOT After=docker.service / NOT RequiresMountsFor=/docker —
# this daemon EXISTS to unlock /docker, so it must run before/without it.

[Service]
Type=simple
ExecStart=/usr/bin/python3 /root/whp/scripts/whp-locked-unlock-daemon.py
# Restart=on-failure only — daemon exits 0 after a successful unlock
# and we WANT it to stay down (no point holding :8444 once /docker is
# unlocked). systemd starts it again on next boot via WantedBy.
Restart=on-failure
RestartSec=5s
StandardOutput=journal
StandardError=journal
SyslogIdentifier=whp-locked-unlock

# Lightweight hardening — daemon needs root (calls unlock helper which
# mounts + starts services). v2 hardening would drop privs and use sudoers.
NoNewPrivileges=false
ProtectSystem=false
ProtectHome=read-only
PrivateTmp=true

[Install]
WantedBy=multi-user.target
