[Unit]
Description=Astra conversation skill for Marusia
After=network-online.target
Wants=network-online.target

[Service]
User=astra
Group=astra
WorkingDirectory=/var/lib/astra-marusia
EnvironmentFile=/etc/astra-marusia.env
Environment=CODEX_HOME=/var/lib/astra-marusia
Environment=HOME=/var/lib/astra-marusia
ExecStart=/usr/bin/python3 /opt/astra-marusia/server.py
Restart=on-failure
RestartSec=5
StateDirectory=astra-marusia
StateDirectoryMode=0700
UMask=0077
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=tmpfs
InaccessiblePaths=-/mnt/backup -/mnt/router -/etc/router.env -/etc/astra-bot.env -/etc/metrics-push -/etc/server-backup -/etc/astra-marusia.env -/opt/media -/opt/astra-bot
ProtectProc=invisible
BindReadOnlyPaths=/home/astra/.codex/auth.json:/var/lib/astra-marusia/auth.json
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
MemoryMax=512M
CPUQuota=100%
TasksMax=64

[Install]
WantedBy=multi-user.target