[Unit]
Description=Seedbox Command Center
Documentation=file:///etc/command-center/DEPLOYMENT.md
# Tailscale must be reachable before we can bind to the tailscale interface.
After=network-online.target tailscaled.service
Wants=network-online.target
Requires=tailscaled.service

[Service]
Type=simple
ExecStart=/usr/local/bin/command-center -config /etc/command-center/config
WorkingDirectory=/var/lib/command-center

# Auto-restart on failure with rate limiting per CLAUDE.md.
Restart=on-failure
RestartSec=5s
StartLimitIntervalSec=120
StartLimitBurst=5

# Run as a dedicated dynamic user; systemd materializes /var/lib/command-center
# and /etc/command-center read-only paths for us.
DynamicUser=yes
StateDirectory=command-center
StateDirectoryMode=0700
ConfigurationDirectory=command-center
ConfigurationDirectoryMode=0750

# Hardening — these match the threat model described in PROJECT.md §5.7
# (single-operator host, no public exposure, secrets protected at rest).
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectClock=true
ProtectHostname=true
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
CapabilityBoundingSet=
AmbientCapabilities=

# Logging goes to journald; the binary emits structured JSON to stdout.
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target