[Unit]
Description=crustd - tiered presence detection for Bread
After=graphical-session.target
PartOf=graphical-session.target

[Service]
Type=simple
ExecStart=%h/.local/bin/crustd
Restart=on-failure
RestartSec=5

# Power/hardening: no network, no writes outside its own state dir, camera access only.
PrivateTmp=true
ProtectSystem=strict
ReadWritePaths=%h/.local/share/crustd %h/.config/crustd
NoNewPrivileges=true
SupplementaryGroups=video
DevicePolicy=closed
DeviceAllow=char-video4linux rw
PrivateNetwork=true
RestrictAddressFamilies=AF_UNIX
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictNamespaces=true
RestrictSUIDSGID=true
LockPersonality=true
SystemCallFilter=@system-service
SystemCallArchitectures=native
UMask=0077
# ProtectProc is deliberately omitted here rather than enabled unverified: it
# restricts visibility into *other* processes' /proc/<pid> entries (not /proc/acpi
# itself, which src/lid.rs reads), so it likely doesn't conflict with lid detection
# — but that's an inference, not a test against real hardware/kernel behavior. Worth
# enabling (e.g. ProtectProc=invisible) once someone can confirm `bread lid` still
# works with it on target hardware.

[Install]
WantedBy=graphical-session.target