[Unit]
Description=Zopu Daemon (Bun/Effect + AgentOS/RivetKit)
After=network-online.target docker.service
Wants=network-online.target

[Service]
Type=simple
User=__SERVICE_USER__
Group=__SERVICE_USER__
WorkingDirectory=__INSTALL_DIR__

EnvironmentFile=__INSTALL_DIR__/.env
Environment=HOME=/var/lib/zopu
StateDirectory=zopu

# RivetKit in-process engine: envoy mode (serverful).
# Run the Bun source entrypoint so AgentOS software assets retain their real
# node_modules paths; Bun compiled executables do not embed .aospkg files.
ExecStart=/usr/local/bin/bun --env-file=__INSTALL_DIR__/.env apps/daemon/src/index.ts

Restart=always
RestartSec=10

StandardOutput=journal
StandardError=journal
SyslogIdentifier=zopu-daemon

# Resource limits (12-core, 40 GB host)
MemoryMax=8G
CPUWeight=100

# Security hardening
NoNewPrivileges=true
ProtectSystem=full
ProtectHome=true
PrivateTmp=true

# Docker socket access (for future Orb sandboxes; group membership required)
SupplementaryGroups=docker

[Install]
WantedBy=multi-user.target