[Unit]
Description=Private reverse SSH tunnel for Marusia webhook
After=network-online.target astra-marusia.service
Wants=network-online.target

[Service]
User=astra
Group=astra
ExecStart=/usr/bin/ssh -NT -i /home/astra/.ssh/marusia_tunnel -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/home/astra/.ssh/known_hosts_marusia -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -o ConnectTimeout=10 -R 127.0.0.1:18788:127.0.0.1:8788 marusia-tunnel@fr1.ruzzy.dev
Restart=always
RestartSec=10
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=read-only
PrivateTmp=yes
UMask=0077

[Install]
WantedBy=multi-user.target