[Unit]
Description=Restore approved Thunderbolt devices and handle new approvals
Wants=bolt.service
After=bolt.service polkit.service
ConditionPathExists=/etc/omarchy/thunderbolt-authorization.enabled

[Service]
Type=simple
ExecStart=/usr/bin/omarchy-thunderbolt-authorization-daemon
RuntimeDirectory=omarchy-thunderbolt-authorization
RuntimeDirectoryMode=0755
Restart=on-failure
RestartSec=2
UMask=0077
NoNewPrivileges=yes
ProtectSystem=strict
ReadWritePaths=/var/lib/omarchy/thunderbolt-authorization /run/lock
ProtectHome=yes
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_UNIX

[Install]
WantedBy=multi-user.target