[Unit]
Description=Workspace Access Server
After=network.target

[Service]
Type=notify
User=workspace-access
Group=workspace-access
WorkingDirectory=/opt/workspace-access
ExecStart=/opt/workspace-access/char_rac_server
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
# .NET named pipes and Data Protection use /tmp. Keep it shared so local control commands can connect.
ReadWritePaths=/tmp
RuntimeDirectory=workspace-access
StateDirectory=workspace-access
UMask=0077

[Install]
WantedBy=multi-user.target