[Unit]
Description=Athena Auth
Documentation=https://github.com/xylex-group/athena-auth
After=network-online.target
Wants=network-online.target
# Enable when PostgreSQL runs as a local systemd unit:
# After=postgresql.service
# Requires=postgresql.service
StartLimitIntervalSec=300
StartLimitBurst=5

[Service]
Type=simple
User=athena-auth
Group=athena-auth

# FHS layout (see scripts/install-systemd.sh):
#   /usr/local/bin/athena-auth          release binary (from target/release/server)
#   /etc/athena-auth/config.yaml        YAML config (observability, schema detection, …)
#   /etc/athena-auth/env                secrets and deployment overrides
#   /var/lib/athena-auth/               writable state (schema-mapping.generated.yaml)
ExecStart=/usr/local/bin/athena-auth
WorkingDirectory=/var/lib/athena-auth

Environment=ATHENA_AUTH_CONFIG_FILE=/etc/athena-auth/config.yaml
Environment=RUST_LOG=info
Environment=RUST_BACKTRACE=1

# Required secrets and deployment values live in /etc/athena-auth/env.
# Copy athena-auth.env.example to that path and edit before enabling.
EnvironmentFile=-/etc/athena-auth/env

Restart=on-failure
RestartSec=5
TimeoutStartSec=120
TimeoutStopSec=30
KillMode=mixed
KillSignal=SIGTERM

# Journald logging (startup banner: "Athena Auth server booted")
StandardOutput=journal
StandardError=journal
SyslogIdentifier=athena-auth

# Health/readiness (after start):
#   curl -fsS "http://127.0.0.1:${PORT:-3000}/api/auth/health"
# Metrics (when enabled in config.yaml):
#   curl -fsS "http://127.0.0.1:${PORT:-3000}/metrics"

LimitNOFILE=65535
LimitCORE=0

# systemd creates and assigns these paths to User/Group on start.
ConfigurationDirectory=athena-auth
ConfigurationDirectoryMode=0750
StateDirectory=athena-auth
StateDirectoryMode=0750

NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectHostname=true
ProtectClock=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
LockPersonality=true
RestrictNamespaces=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
UMask=0027

[Install]
WantedBy=multi-user.target