[Unit]
Description=compare.sr.ht git diff/compare viewer
After=network.target

[Service]
Type=simple
# Runs as the git user so it has read access to the bare repositories under
# /var/lib/git. compare.sr.ht is stateless — no database or Redis dependency.
User=git
Restart=always
ExecStart=/usr/local/bin/comparesrht

# The service only ever reads: bare repos on disk and the shared config. It
# writes nothing, so lock the filesystem down.
ProtectSystem=strict
ProtectHome=true
ReadOnlyPaths=/var/lib/git
PrivateTmp=true
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target