[Unit]
Description=thought stream public site and authenticated inspector proxy
After=thoughtstream-inspector.service
Requires=thoughtstream-inspector.service

[Service]
# Singleton contract: never template or replicate this unit against one OAUTH_STORE_DIR.
# The process also holds an owner-only store lock and refuses a second live owner.
Type=simple
WorkingDirectory=%h/code/thought-stream
EnvironmentFile=-%h/.config/thoughtstream/credentials/inspector-basic.env
EnvironmentFile=-%h/.config/thoughtstream/credentials/inspector-oauth.env
EnvironmentFile=-%h/.config/thoughtstream/credentials/inspector-review.env
EnvironmentFile=-%h/.config/thoughtstream/credentials/inspector-course-chat.env
# Optional credentials for the fixed Co adapter; the API key may be account-wide.
# Never load the consumers/connector env files here.
EnvironmentFile=-%h/.config/thoughtstream/credentials/inspector-co-chat.env
ExecStart=%h/.nvm/versions/node/v22.19.0/bin/node --import tsx %h/code/thought-stream/scripts/serve-inspector-proxy.ts
Restart=on-failure
RestartSec=5
KillMode=control-group
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=-%h/.local/share/thoughtstream-inspector-auth
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
UMask=0077

[Install]
WantedBy=default.target