[Unit]
Description=Zopu Agent Service (Flue Node server)
After=network-online.target zopu-daemon.service
Wants=network-online.target

[Service]
Type=simple
User=__SERVICE_USER__
Group=__SERVICE_USER__
WorkingDirectory=__INSTALL_DIR__/packages/agents

EnvironmentFile=__INSTALL_DIR__/.env
Environment=PORT=3583

# Flue's Node target requires Node built-ins such as node:sqlite.
# Listens on the service-pinned port 3583.
ExecStart=/usr/bin/node dist/server.mjs

Restart=always
RestartSec=10

StandardOutput=journal
StandardError=journal
SyslogIdentifier=zopu-agent

# Resource limits
MemoryMax=8G
CPUWeight=80

# Security hardening
NoNewPrivileges=true
ProtectSystem=full
ProtectHome=true
PrivateTmp=true

# Docker socket access for Orb sandbox runtime (lives in agent process)
SupplementaryGroups=docker

[Install]
WantedBy=multi-user.target