# Steid as a systemd service.
#
# This is the reference copy, for the manual installation path in README.md.
# install.sh writes an identical file to /etc/systemd/system/steid.service —
# if you change one, change the other.
#
# Assumes the layout install.sh creates:
#   /opt/steid/steid       the binary
#   /opt/steid/assets/     the asset bundle, which MUST sit beside the binary
#   /var/lib/steid/        all state: the SQLite database and the bare repos
#   /etc/steid/steid.env   configuration

[Unit]
Description=Steid
Documentation=https://jpgill.dev/jamesgill/repos/steid
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=steid
Group=steid

# WorkingDirectory is /opt/steid, where nothing is written. The asset bundle is
# found either way — `AssetBundle::load()` resolves relative to the executable,
# verified by running the binary from `/` — but `dotenvy` reads `.env` from the
# *working directory*, so pointing this at the state directory would let a file
# dropped there silently override the configuration below.
WorkingDirectory=/opt/steid
ExecStart=/opt/steid/steid
EnvironmentFile=/etc/steid/steid.env

# git reads and writes config relative to HOME, and it is not optional: without
# it git warns, and in some setups fails, on every subprocess Steid spawns.
Environment=HOME=/var/lib/steid

Restart=on-failure
RestartSec=2s

# Hardening. Steid needs exactly one writable path, executes git from /usr, and
# talks to nothing but the loopback listener, so most of this is free.
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictNamespaces=true
LockPersonality=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
ReadWritePaths=/var/lib/steid

[Install]
WantedBy=multi-user.target