[Unit]
Description=Worf Agent - Dynamic IP blocklist manager
After=network-online.target redis.service
Wants=network-online.target
# Never stop retrying. The default limiter gives up after 5 starts in 10s and
# leaves the unit failed, which for a security control is the worst outcome.
# Must be in [Unit]; systemd ignores it in [Service].
StartLimitIntervalSec=0

[Service]
Type=simple
ExecStart=/usr/local/bin/worf-agent --config /etc/worf-agent.conf
ExecReload=/bin/kill -HUP $MAINPID
# always, not on-failure: SIGTERM from anything other than systemctl makes the
# agent exit 0, and on-failure would leave the host silently not blocking.
Restart=always
RestartSec=5

# The default 1024 soft limit is what the agent hit in INFRA-37804. The metrics
# server now caps its own descriptor use, so this is headroom, not the fix.
LimitNOFILE=65536

# /run/worf-agent holds the status file. RuntimeDirectory= creates it before the
# mount namespace is set up and makes it writable; a bare ReadWritePaths= entry
# would fail with 226/NAMESPACE on every boot because /run is a fresh tmpfs.
RuntimeDirectory=worf-agent
RuntimeDirectoryMode=0755

# The persist target must exist before ProtectSystem=strict can bind-mount it
# read-write. The + prefix runs this outside the sandbox so it can create the
# file on a fresh install.
ExecStartPre=+/bin/sh -c 'test -e /etc/nftables-dynamic.conf || : > /etc/nftables-dynamic.conf'

# Security hardening
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
ReadWritePaths=/etc/nftables-dynamic.conf

# nft needs CAP_NET_ADMIN
AmbientCapabilities=CAP_NET_ADMIN
CapabilityBoundingSet=CAP_NET_ADMIN

Environment=RUST_LOG=info

[Install]
WantedBy=multi-user.target