[Unit]
Description=Jibo Hub Shim (v1/listen)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
WorkingDirectory=/opt/jibo-hub-shim
EnvironmentFile=-/etc/jibo-hub-shim/jibo-hub-shim.env
ExecStart=/usr/bin/env node /opt/jibo-hub-shim/index.js ${JIBO_HUB_SHIM_CONFIG}
Restart=always
RestartSec=2

# Hardening (keep minimal; shim needs network only)
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true

[Install]
WantedBy=multi-user.target