[Unit]
Description=Sign approved MPV Manager stable metadata for %i

[Service]
Type=oneshot
User=mpv-manifest-signer
Group=mpv-manifest-signer
WorkingDirectory=/var/lib/mpv-release-signer/v%i
Environment=RELEASE_CHANNEL=stable
EnvironmentFile=/var/lib/mpv-release-signer/v%i/job.env
LoadCredential=manifest-key:/var/lib/mpv-release-keys/stable-2026-09.seed
ExecStart=/usr/local/libexec/mpv-sign-reviewed-release %i
UMask=0077
NoNewPrivileges=yes
PrivateNetwork=yes
RestrictAddressFamilies=AF_UNIX
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
CapabilityBoundingSet=
ReadWritePaths=/var/lib/mpv-release-signer/v%i/output
TimeoutStartSec=180