sync: update from private repo (edc775f2)

deploy/maestro.service

@@ -1,25 +1,53 @@
+# MAESTRO systemd unit — TEMPLATE.
+#
+# Do not install this file verbatim: the @TOKENS@ below are placeholders.
+# Use the installer, which fills them in from the current checkout and enables
+# boot autostart in one step:
+#
+#   scripts/install-systemd.sh            # user service (no root, runs as you) [default]
+#   scripts/install-systemd.sh --print    # preview the generated unit, install nothing
+#   scripts/install-systemd.sh --mode system --run-as <user>
+#
+# See docs/systemd-autostart.md for details.
+#
+# The service runs `node dist/main.js` directly (systemd supervises it). It does
+# NOT build — build first with `scripts/server.sh start` (or `npm run build`) so
+# dist/ is fresh, then let systemd own the running process. Do not run
+# `server.sh start` and the systemd service at the same time (double-start).
+
 [Unit]
-Description=MAESTRO
-After=network.target
+Description=MAESTRO agent orchestrator
+Documentation=file://@PROJECT_DIR@/docs/systemd-autostart.md
+After=network-online.target
+Wants=network-online.target
 
 [Service]
 Type=simple
-User=maestro
-WorkingDirectory=/opt/maestro
-ExecStart=/usr/bin/node dist/index.js
+User=@RUN_USER@
+WorkingDirectory=@PROJECT_DIR@
+# Default run mode (worker = full orchestrator). Override via .env if needed.
+Environment=AAO_MODE=worker
+# Optional project .env (KEY=value per line). `-` = ignore if missing.
+# NOTE: systemd parses this file itself; keep values simple KEY=value. The rich
+# quoting server.sh understands is not applied here.
+EnvironmentFile=-@PROJECT_DIR@/.env
+ExecStart=@NODE@ dist/main.js
 Restart=on-failure
 RestartSec=10
-EnvironmentFile=/opt/maestro/.env
+TimeoutStopSec=30
 
-# Logging
+# Logging → journald.  Tail with: journalctl -u maestro -f
 StandardOutput=journal
 StandardError=journal
 SyslogIdentifier=maestro
 
-# Security hardening
+# Security hardening. ProtectSystem=full keeps /usr, /boot, /efi and /etc
+# read-only while leaving the checkout, /home, /tmp and /var writable — enough
+# for the default layout (data/, logs/, data/workspaces all live under the
+# checkout). Tighten to ProtectSystem=strict + explicit ReadWritePaths= if your
+# deployment writes outside the checkout.
 NoNewPrivileges=true
-ProtectSystem=strict
-ReadWritePaths=/opt/maestro/data /var/lib/maestro/workspaces
+ProtectSystem=full
 
 [Install]
 WantedBy=multi-user.target