[Unit]
Description=The initramfs images with the CPU's current microcode
# Module kernel, novox/hq issue 1977. Starting this unit builds the images again when the microcode drop-in
# changed since they were last built; a failed mkinitcpio fails the unit. The microcode packages are declared
# before this unit.
After=local-fs.target
Wants=local-fs.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=${dir:state}/initramfs apply
# It writes the boot partition and its own state; mkinitcpio keeps its work in a private /tmp.
ProtectSystem=strict
ReadWritePaths=/boot ${dir:state}
PrivateTmp=yes
ProtectHome=yes
PrivateNetwork=yes
NoNewPrivileges=yes

[Install]
WantedBy=multi-user.target