# RELAY-PHASE1 · E (TASK E) — relay data-plane (P1) systemd unit. STAGING TEMPLATE.
#
# Runs the Phase-1 relay entry (relay-run/src/main-phase1.ts via `start:phase1`, added in B5): browser
# WSS on :443 (BIND_PORT) and agent mTLS on AGENT_BIND_PORT. Stateless / restart-safe (INV7) — all
# state is in Postgres/Redis, so bouncing this unit does NOT drop host registrations or kill PTYs.
#
# INSTALL (adjust the placeholder paths to your VPS):
#   1) clone the repo to /opt/web-terminal (or edit --prefix below)
#   2) install:  sudo cp deploy/systemd/relay-data-plane.service /etc/systemd/system/
#   3) put the filled env at /etc/relay/relay.env  (0600, owned by the service user)
#   4) sudo systemctl daemon-reload && sudo systemctl enable --now relay-data-plane.service
#
# The env file supplies BIND_HOST/BIND_PORT/TLS_*/AGENT_BIND_PORT/AGENT_CA_*/BASE_DOMAIN/
# RELAY_NODE_ID/RELAY_AUTH_VERIFY_PUBKEY/RELAY_TRUST_DOMAIN/PG_URL/REDIS_URL (see .env.example).

[Unit]
Description=web-terminal rendezvous-relay DATA PLANE (P1, Phase 1)
Documentation=file:///opt/web-terminal/docs/PLAN_RELAY_PHASE1.md
# Reads the SAME Postgres/Redis as the control-plane (routes, revocations, registries).
After=network-online.target docker.service relay-control-plane.service
Wants=network-online.target
Requires=docker.service

[Service]
Type=simple
User=relay
Group=relay
WorkingDirectory=/opt/web-terminal
EnvironmentFile=/etc/relay/relay.env
# Runs relay-run "start:phase1" (relay-run/package.json -> tsx src/main-phase1.ts).
ExecStart=/usr/bin/env npm --prefix /opt/web-terminal/relay-run run start:phase1
Restart=always
RestartSec=3
TimeoutStopSec=20
KillSignal=SIGTERM

# Bind the privileged browser port :443 WITHOUT running as root (least privilege).
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

# --- hardening ---
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
ProtectControlGroups=true
ProtectKernelTunables=true
RestrictSUIDSGID=true
# TLS keys + the pinned agent-CA bundle are read-only to the relay.
ReadOnlyPaths=/etc/relay

[Install]
WantedBy=multi-user.target