[Unit]
Description=CertiSigma Census — periodic integrity check
After=network.target
Documentation=https://github.com/certisigma/certisigma-census

[Service]
Type=oneshot
User=census
Group=census
ExecStart=/usr/local/bin/census integrity /var/lib/census/manifest.db --strict --format jsonl
StandardOutput=append:/var/log/census/integrity.jsonl
StandardError=journal

# Hardening
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/var/log/census
PrivateTmp=yes
