# LLeMbas system service.
#
# Deployed to /etc/systemd/system/lembas.service by deploy/install.sh.
#
# A system unit, not a user unit, so it survives logout and comes up at boot
# without anyone signing in -- matching llama-swap and comfyui on this box.
#
# /srv/lembas is a bind mount of /home/lembas: the root LV is only 50 GB and
# the venv plus SQLite database belong on /home, same trick as /srv/llama.

[Unit]
Description=LLeMbas - web UI for language models
Documentation=https://git.houmeres.sk/Houmeres/LLeMbas
After=network-online.target
Wants=network-online.target
# The unit is useless without the bind mount: the venv and database live there.
RequiresMountsFor=/srv/lembas
# Not a hard dependency. LLeMbas starts fine with the endpoint down and shows a
# readable error in the admin UI, which is better than refusing to boot.
After=llama-swap.service

[Service]
Type=simple
User=lembas
Group=lembas
WorkingDirectory=/srv/lembas/app
EnvironmentFile=/srv/lembas/lembas.env
ExecStart=/srv/lembas/venv/bin/lembas serve
Restart=on-failure
RestartSec=5

# Reachable only through the nginx chat.lan vhost, never directly on the LAN.
# The bind address is set by LEMBAS_HOST in the environment file.

# --- Hardening -------------------------------------------------------------
# Modest rather than maximal: the agentic features planned for later will need
# to run commands, so ProtectSystem=strict would only be torn out again.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ProtectKernelTunables=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
# Only /srv/lembas needs to be writable; /home/lembas is the same inode.
ReadWritePaths=/srv/lembas
LimitNOFILE=65535

[Install]
WantedBy=multi-user.target