# Sorcery-Go Package Management Engine — systemd unit
# File: /etc/systemd/system/sorcery-go.service
#
# Install with:
#   sudo cp sorcery-go.service /etc/systemd/system/
#   sudo systemctl daemon-reload
#   sudo systemctl enable --now sorcery-go
#
# Security is enforced by eBPF LSM programs (Tomb Guard + cgroup filters).
# No AppArmor profile is needed — the eBPF programs handle MAC at kernel level.

[Unit]
Description=Sorcery-Go Sovereign Coven Engine (eBPF-enforced)
Documentation=https://git.dcos.net/dcosnet/sorcery-go
After=network-online.target
Wants=network-online.target
ConditionPathExists=/var/lib/sorcery-go/state/state.db

[Service]
Type=simple
ExecStart=/usr/local/sbin/sorcery-go web --port 8080 --cockpit-integration
Restart=on-failure
RestartSec=5

# Capabilities required for OverlayFS, chown, DAC override, and eBPF program loading.
AmbientCapabilities=CAP_SYS_ADMIN CAP_CHOWN CAP_DAC_OVERRIDE CAP_BPF
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_CHOWN CAP_DAC_OVERRIDE CAP_BPF

# Security hardening (eBPF LSM provides MAC — AppArmor/SELinux not required)
PrivateTmp=yes
ProtectSystem=full
ProtectHome=yes
NoNewPrivileges=yes
ReadWritePaths=/var/lib/sorcery-go /var/spool/sorcery-go /var/lib/sorcery-go/ebpf/maps

# Environment
Environment=SORCERY_GO_ROOT=/var/lib/sorcery-go
Environment=SORCERY_GO_RUNTIME=auto
Environment=SORCERY_GO_EBPF_ENFORCE=true

# Resource limits (builds can be heavy)
LimitNOFILE=65536
TasksMax=infinity

[Install]
WantedBy=multi-user.target