[Unit]
Description=Styrene Device Agent - RPC Server over LXMF
Documentation=https://github.com/vanderlyn/styrene-tui
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=styrene
Group=styrene
WorkingDirectory=/opt/styrene-agent

# Environment
Environment="PYTHONUNBUFFERED=1"
Environment="STYRENE_CONFIG=/etc/styrene-agent/auth.yaml"

# Main process
ExecStart=/opt/styrene-agent/venv/bin/python3 /opt/styrene-agent/styrene-device-agent.py --config /etc/styrene-agent/auth.yaml

# Restart configuration
Restart=always
RestartSec=10
StartLimitInterval=300
StartLimitBurst=5

# Resource limits
MemoryLimit=512M
CPUQuota=50%

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/log/styrene-agent /var/lib/styrene-agent /home/styrene/.reticulum
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=true
RestrictNamespaces=true

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=styrene-agent

[Install]
WantedBy=multi-user.target
