[Unit]
Description=w3cs WebTransport bridge (QUIC command planes)
After=network-online.target
Wants=network-online.target

[Service]
# One bridge serves every seat: /seat/N on UDP 443 (primary; what
# middleboxes let through) and UDP 4443 (legacy secondary) attaches to the
# seat's relay WebSocket planes on 8144+N. Root only because the Let's
# Encrypt private key behind /etc/ssl/w3cs is root-owned (and it binds
# 443). nginx holds TCP 443; the UDP side is the bridge's.
ExecStart=/usr/local/sbin/w3cs-wt-bridge
Restart=always
RestartSec=2
NoNewPrivileges=yes

[Install]
WantedBy=multi-user.target