[Unit]
Description=Tor hidden service for TRI Bootstrap Server
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
# Run Tor as the debian-tor user (standard on Debian/Ubuntu)
User=debian-tor
Group=debian-tor
ExecStart=/usr/bin/tor -f /etc/tor/tri-bootstrap/torrc
Restart=on-failure
RestartSec=10

# Hardening
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadOnlyPaths=/etc/tor/tri-bootstrap
WritePaths=/var/lib/tor/tri-bootstrap

[Install]
WantedBy=multi-user.target