[Unit]
Description=Reap expired QQQ script containers with verified ownership
After=docker.service

[Service]
Type=oneshot
User=qqq-worker
Group=qqq-worker
EnvironmentFile=/etc/qqq-worker/runtime.env
WorkingDirectory=/opt/qqq-worker
ExecStart=/opt/node/bin/node /opt/qqq-worker/dist/reaper-cli.js
TimeoutStartSec=120
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/qqq-worker

[Install]
WantedBy=multi-user.target