[Unit]
Description=Read-only Matrix K3s health check
Wants=network-online.target
After=network-online.target k3s.service

[Service]
Type=oneshot
User=root
Group=root
UMask=0027
ExecStart={{ matrix_healthcheck_script_path }}
NoNewPrivileges=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=full
ReadWritePaths={{ matrix_healthcheck_state_path | dirname }}