[Unit]
Description=Oracle bounded local signer
After=network-online.target

[Service]
Type=simple
ExecStart=%h/.local/bin/oracle signer --credential-service oracle-local-signer --session-seconds 120
Restart=no
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=%h/.config/oracle

[Install]
WantedBy=default.target