# LLeMbas system service template.
#
# install.sh substitutes __PREFIX__ and __SERVICE_USER__ and writes the result
# to /etc/systemd/system/lembas.service. Edit this file, not the installed copy.
#
# A system unit, not a user unit, so it survives logout and comes up at boot
# without anyone signing in.

[Unit]
Description=LLeMbas - web UI for language models
After=network-online.target
Wants=network-online.target
# The prefix is usually a bind mount; the venv and database live there, so
# starting before it is mounted would create an empty database in its place.
RequiresMountsFor=__PREFIX__

[Service]
Type=simple
User=__SERVICE_USER__
Group=__SERVICE_USER__
WorkingDirectory=__PREFIX__/app
EnvironmentFile=__PREFIX__/lembas.env
ExecStart=__PREFIX__/venv/bin/lembas serve
Restart=on-failure
RestartSec=5

# The bind address comes from LEMBAS_HOST in the environment file, which the
# installer sets to 127.0.0.1: reachable through nginx, never directly.

# --- Hardening -------------------------------------------------------------
# Moderate rather than maximal. The agentic features planned for later need to
# run commands, and a lockdown that has to be torn out again is worse than one
# that was never applied.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ProtectKernelTunables=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
ReadWritePaths=__PREFIX__
LimitNOFILE=65535

[Install]
WantedBy=multi-user.target