54 lines
2.0 KiB
Desktop File
54 lines
2.0 KiB
Desktop File
# MAESTRO systemd unit — TEMPLATE.
|
|
#
|
|
# Do not install this file verbatim: the @TOKENS@ below are placeholders.
|
|
# Use the installer, which fills them in from the current checkout and enables
|
|
# boot autostart in one step:
|
|
#
|
|
# scripts/install-systemd.sh # user service (no root, runs as you) [default]
|
|
# scripts/install-systemd.sh --print # preview the generated unit, install nothing
|
|
# scripts/install-systemd.sh --mode system --run-as <user>
|
|
#
|
|
# See docs/systemd-autostart.md for details.
|
|
#
|
|
# The service runs `node dist/main.js` directly (systemd supervises it). It does
|
|
# NOT build — build first with `scripts/server.sh start` (or `npm run build`) so
|
|
# dist/ is fresh, then let systemd own the running process. Do not run
|
|
# `server.sh start` and the systemd service at the same time (double-start).
|
|
|
|
[Unit]
|
|
Description=MAESTRO agent orchestrator
|
|
Documentation=file://@PROJECT_DIR@/docs/systemd-autostart.md
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=@RUN_USER@
|
|
WorkingDirectory=@PROJECT_DIR@
|
|
# Default run mode (worker = full orchestrator). Override via .env if needed.
|
|
Environment=AAO_MODE=worker
|
|
# Optional project .env (KEY=value per line). `-` = ignore if missing.
|
|
# NOTE: systemd parses this file itself; keep values simple KEY=value. The rich
|
|
# quoting server.sh understands is not applied here.
|
|
EnvironmentFile=-@PROJECT_DIR@/.env
|
|
ExecStart=@NODE@ dist/main.js
|
|
Restart=on-failure
|
|
RestartSec=10
|
|
TimeoutStopSec=30
|
|
|
|
# Logging → journald. Tail with: journalctl -u maestro -f
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=maestro
|
|
|
|
# Security hardening. ProtectSystem=full keeps /usr, /boot, /efi and /etc
|
|
# read-only while leaving the checkout, /home, /tmp and /var writable — enough
|
|
# for the default layout (data/, logs/, data/workspaces all live under the
|
|
# checkout). Tighten to ProtectSystem=strict + explicit ReadWritePaths= if your
|
|
# deployment writes outside the checkout.
|
|
NoNewPrivileges=true
|
|
ProtectSystem=full
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|