# SPDX-License-Identifier: Apache-2.0
# (c) 2026 BANKON — all rights reserved.
#
# Systemd unit for running WordPress.agent directly under a virtualenv.
# Use this when you do not want the container layer.
#
# Install:
#   sudo cp deploy/systemd/wordpress-agent.service /etc/systemd/system/
#   sudo systemctl daemon-reload
#   sudo systemctl enable --now wordpress-agent.service
#   sudo systemctl status wordpress-agent.service

[Unit]
Description=WordPress.agent — agnostic publishing tool for mindX
Documentation=https://github.com/codephreak/wordpress-agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=wpagent
Group=wpagent
WorkingDirectory=/opt/wordpress-agent
EnvironmentFile=/etc/wordpress-agent/wordpress-agent.env
ExecStart=/opt/wordpress-agent/.venv/bin/wordpress-agent-server
Restart=on-failure
RestartSec=5s
TimeoutStopSec=30s
KillMode=mixed

# Hardening
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=true
LockPersonality=true
MemoryDenyWriteExecute=true
ReadWritePaths=
ReadOnlyPaths=/etc/wordpress-agent

# Resource limits
LimitNOFILE=65536
MemoryMax=256M
CPUQuota=50%

[Install]
WantedBy=multi-user.target