# SPDX-License-Identifier: AGPL-3.0-only
[Unit]
Description=Gamertan Observatory production agent
After=network-online.target gamertan-observatory.service
Wants=network-online.target
PartOf=gamertan-observatory.service

[Service]
Type=simple
User=observatory-agent
Group=observatory-agent
SupplementaryGroups=caddy eqlwiki gamertancom
LoadCredential=agent.json:/etc/gamertan-observatory/agent.json
LoadCredential=agent-credential.json:/etc/gamertan-observatory/agent-credential.json
ExecStart=/opt/gamertan-observatory/current/observatory agent --systemd-credentials --config %d/agent.json --credential-file %d/agent-credential.json
Restart=on-failure
RestartSec=5s
TimeoutStartSec=20s
TimeoutStopSec=20s
KillMode=mixed
UMask=0077

StateDirectory=gamertan-observatory-agent
StateDirectoryMode=0700
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=yes
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=strict
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
CapabilityBoundingSet=
AmbientCapabilities=
ReadOnlyPaths=/proc /sys/fs/cgroup /var/log/caddy /var/log/eqlwiki /opt/gamertancom/deployment-events.jsonl /opt/sandwich-hime-site/deployment-events.jsonl /opt/gamertan-observatory/deployment-events.jsonl
ReadWritePaths=/var/lib/gamertan-observatory-agent
TasksMax=64
MemoryMax=256M
LimitNOFILE=1024

[Install]
WantedBy=multi-user.target