[Unit]
Description=tsunagi mesh agent
Documentation=https://github.com/house-of-vanity/tsunagi
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
# Runs as a dedicated unprivileged user, not root. The two capabilities are all
# it needs: CAP_NET_ADMIN to create and configure the TUN interface, and
# CAP_NET_BIND_SERVICE for low ports. The packages create the `tsunagi` user.
User=tsunagi
Group=tsunagi
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE

# systemd creates and owns these for the service user, and the agent is pointed
# at them: state in /var/lib/tsunagi, cache in /var/cache/tsunagi, and the
# control socket in /run/tsunagi. The socket is opened to the `tsunagi` group,
# so a user who joins it can run the CLI and the tray without sudo.
StateDirectory=tsunagi
StateDirectoryMode=0700
CacheDirectory=tsunagi
RuntimeDirectory=tsunagi
RuntimeDirectoryMode=0755
Environment=TSUNAGI_STATE_DIR=%S/tsunagi
Environment=TSUNAGI_CACHE_DIR=%C/tsunagi
Environment=TSUNAGI_CONTROL_SOCKET=%t/tsunagi/agent.sock
Environment=TSUNAGI_CONTROL_GROUP=tsunagi

# The tarball installer puts the binary here; the deb and the Arch package
# rewrite this to /usr/bin where they install it.
ExecStart=/usr/local/bin/tsng up
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target