[Unit]
Description=ssh-access-tui audit journal tailer (connect/disconnect log)
After=network.target sshd.service ssh.service
Wants=ssh.service

[Service]
Type=simple
ExecStart=/usr/local/bin/ssh-access-tui audit-tail
Restart=always
RestartSec=5
User=root
# Read-only access to system state is enough; this process only appends to
# the audit log and reads the systemd journal.
ProtectSystem=strict
ReadWritePaths=/var/lib/ssh-access-tui/audit
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target