# MAESTRO systemd unit — TEMPLATE.
#
# Do not install this file verbatim: the @TOKENS@ below are placeholders.
# Use the installer, which fills them in from the current checkout and enables
# boot autostart in one step:
#
#   scripts/install-systemd.sh            # user service (no root, runs as you) [default]
#   scripts/install-systemd.sh --print    # preview the generated unit, install nothing
#   scripts/install-systemd.sh --mode system --run-as <user>
#
# See docs/systemd-autostart.md for details.
#
# The service runs `node dist/main.js` directly (systemd supervises it). It does
# NOT build — build first with `scripts/server.sh start` (or `npm run build`) so
# dist/ is fresh, then let systemd own the running process. Do not run
# `server.sh start` and the systemd service at the same time (double-start).

[Unit]
Description=MAESTRO agent orchestrator
Documentation=file://@PROJECT_DIR@/docs/systemd-autostart.md
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=@RUN_USER@
WorkingDirectory=@PROJECT_DIR@
# Default run mode (worker = full orchestrator). Override via .env if needed.
Environment=AAO_MODE=worker
# Optional project .env (KEY=value per line). `-` = ignore if missing.
# NOTE: systemd parses this file itself; keep values simple KEY=value. The rich
# quoting server.sh understands is not applied here.
EnvironmentFile=-@PROJECT_DIR@/.env
ExecStart=@NODE@ dist/main.js
Restart=on-failure
RestartSec=10
TimeoutStopSec=30

# Logging → journald.  Tail with: journalctl -u maestro -f
StandardOutput=journal
StandardError=journal
SyslogIdentifier=maestro

# Security hardening. ProtectSystem=full keeps /usr, /boot, /efi and /etc
# read-only while leaving the checkout, /home, /tmp and /var writable — enough
# for the default layout (data/, logs/, data/workspaces all live under the
# checkout). Tighten to ProtectSystem=strict + explicit ReadWritePaths= if your
# deployment writes outside the checkout.
NoNewPrivileges=true
ProtectSystem=full

[Install]
WantedBy=multi-user.target