# Clusev WireGuard write-request handler — oneshot (HOST-side). Triggered by clusev-wg-request.path
# when the dashboard writes run/wg-request.json. Runs `clusev-wg.sh serve-request`, which consumes
# the request, whitelists the action + re-validates args, runs the fixed command, and writes a
# result file the app reads once. install.sh rewrites the /home/nexxo/clusev paths.
[Unit]
Description=Clusev WireGuard write-request handler
After=docker.service

[Service]
Type=oneshot
User=root
# Result/QR files carry a freshly-minted private key — keep them 0600 from birth (run/ is 0775).
UMask=0077
Environment=CLUSEV_DIR=/home/nexxo/clusev
WorkingDirectory=/home/nexxo/clusev
ExecStart=/home/nexxo/clusev/docker/wg/clusev-wg.sh serve-request