[Unit]
Description=HotPlex Worker Gateway
Documentation=https://github.com/hrygo/hotplex
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
User=hotplex
Group=hotplex
# WorkingDirectory should match worker.default_work_dir in config.yaml.
# The default is /var/lib/hotplex for system-level installations.
WorkingDirectory=/var/lib/hotplex

# Load environment variables from secrets file
EnvironmentFile=/etc/hotplex/secrets.env

# Main executable
ExecStart=/usr/local/bin/hotplex \
    -config /etc/hotplex/config.yaml

# Graceful shutdown
ExecReload=/bin/kill -HUP $MAINPID
TimeoutStopSec=30
KillMode=mixed
KillSignal=SIGTERM

# Restart policy
Restart=on-failure
RestartSec=5

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectControlGroups=true
ProtectKernelModules=true
PrivateDevices=true
PrivateNetwork=false
PrivateUsers=true

# Allow write access to data and log directories
ReadWritePaths=/var/lib/hotplex /var/log/hotplex

# Prevent privilege escalation
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE

# Resource limits
LimitNOFILE=65536
LimitNPROC=4096
LimitCORE=0

# Go runtime memory limit (soft limit for GC pacing)
Environment=GOMEMLIMIT=6500MiB

# OOM Score (higher = less likely to be killed)
OOMScoreAdjust=-500

# Watchdog (if using systemd watchdog)
WatchdogSec=30

# Standard output and error
StandardOutput=journal
StandardError=journal
SyslogIdentifier=hotplex

[Install]
WantedBy=multi-user.target
