[Unit]
Description=Read-only VPS health check (%i)
Wants=network-online.target
After=network-online.target docker.service

[Service]
Type=oneshot
User=root
Group=root
UMask=0027
ExecStart={{ healthcheck_install_root }}/run
# The optional dispatcher is installed only by email_alert when explicitly enabled.
# This service remains healthy if alerting is intentionally unavailable.
ExecStartPost=-/usr/local/lib/vps-health/alert-dispatch
NoNewPrivileges=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=full
ReadWritePaths={{ healthcheck_state_dir }} {{ healthcheck_log_dir }}