# Mosaic Case 1 host check at boot (row 240, #1746; r6 B2). Root installs it as
# /etc/systemd/system/mosaic-hostcheck.service, root:root 0644, and enables it
# (docs/guides/host-run-sheet.md). It runs the drift stop before the bus starts, which covers a kernel
# or parser change that takes effect at boot. --enforce always exits 0; on drift it closes bwrap to
# root, and every role session then refuses to start.
[Unit]
Description=Mosaic Case 1 host check: the bwrap profile, the statoverride and the sysctls
After=apparmor.service
Before=mosaic-bus@mosaic-stack.service

[Service]
Type=oneshot
ExecStart=/usr/local/lib/mosaic-stack/hostcheck.sh --enforce

[Install]
WantedBy=multi-user.target