[Unit]
Description=CASAN immutable audit-head anchor
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
User=casan
Group=casan
EnvironmentFile=/etc/casan/production.env
Environment=CASAN_PROFILE=prod
ExecStart=/srv/casan/repo/packages/casan-harness/scripts/bash/audit-ship-s3.sh /srv/casan/state/logs/audit/audit-head.txt
NoNewPrivileges=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=strict
ReadWritePaths=/srv/casan/state