# systemd unit for the secs_gemd SECS/GEM daemon.
#
#   install -m644 deploy/secs_gemd.service /etc/systemd/system/
#   install -m755 build/secs_gemd /usr/local/bin/
#   mkdir -p /etc/secsgem && cp data/*.yaml /etc/secsgem/
#   systemctl enable --now secs_gemd
#
# The tool API rides a Unix domain socket (no network exposure at all);
# point the Python/C++ client at unix:///run/secs_gemd/api.sock. The HSMS
# port (5000) faces the fab host — firewall it to the host's address (see
# docs/SECURITY.md for the nftables recipe).

[Unit]
Description=SECS/GEM equipment daemon (secs_gemd)
After=network-online.target
Wants=network-online.target

[Service]
Type=exec
ExecStart=/usr/local/bin/secs_gemd \
    --port 5000 \
    --grpc unix:///run/secs_gemd/api.sock \
    --metrics 9091 \
    --config-dir /etc/secsgem \
    --spool-dir /var/lib/secs_gemd/spool
RuntimeDirectory=secs_gemd
StateDirectory=secs_gemd
# SIGTERM triggers the daemon's graceful shutdown (drains gRPC, stops the
# engine, exit 0); give it a moment before SIGKILL.
TimeoutStopSec=10
Restart=always
RestartSec=2
# Hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/secs_gemd
DynamicUser=true

[Install]
WantedBy=multi-user.target