[Unit]
Description=Zopu Daemon (Bun/Effect + AgentOS/RivetKit)
After=network-online.target docker.service
Wants=network-online.target

[Service]
Type=simple
User=__SERVICE_USER__
Group=__SERVICE_USER__
WorkingDirectory=__INSTALL_DIR__

EnvironmentFile=__INSTALL_DIR__/.env

# RivetKit in-process engine: envoy mode (serverful).
# registry.start() boots the native Rust sidecar and actor envoy.
# RIVET_ENDPOINT defaults to http://localhost:6420 inside the daemon process.
ExecStart=__INSTALL_DIR__/apps/daemon/dist/code-daemon

Restart=always
RestartSec=10

StandardOutput=journal
StandardError=journal
SyslogIdentifier=zopu-daemon

# Resource limits (12-core, 40 GB host)
MemoryMax=8G
CPUWeight=100

# Security hardening
NoNewPrivileges=true
ProtectSystem=full
ProtectHome=true
PrivateTmp=true

# Docker socket access (for future Orb sandboxes; group membership required)
SupplementaryGroups=docker

[Install]
WantedBy=multi-user.target