[Unit]
Description=WireGuard Dynamic Policy Firewall Watcher
After=network-online.target wg-quick@wg0.service
Wants=wg-quick@wg0.service network-online.target
StartLimitIntervalSec=60
StartLimitBurst=5

[Service]
Type=simple
ExecStartPre=/usr/local/bin/wg-policy-engine.sh --health-check
ExecStart=/usr/local/bin/wg-sync-watch.sh
ExecStopPost=/usr/local/bin/wg-policy-cleanup.sh
Restart=always
RestartSec=10
User=root
StandardOutput=journal
StandardError=journal
SyslogIdentifier=wg-policy

# Hardening
ProtectSystem=strict
ReadWritePaths=/etc/wireguard /var/lock /tmp
ProtectHome=yes
NoNewPrivileges=no
PrivateTmp=yes

[Install]
WantedBy=multi-user.target