# Episode 14: dumps CrowdSec's WAF alerts to a JSON file for ops-readonly.
# Runs on the host, because cscli needs machine credentials that can also write.
#   cp ops-readonly/waf-export.{service,timer} /etc/systemd/system/
#   systemctl daemon-reload && systemctl enable --now waf-export.timer
[Unit]
Description=Export CrowdSec WAF alerts for the read-only agent tool
After=crowdsec.service

[Service]
Type=oneshot
ExecStart=/usr/bin/python3 /opt/selfhostedops-stack/ops-readonly/waf-export.py
Nice=10