# systemd unit for the LPRA host (server).
#
# Unlike the agent, the server does NOT need root: it listens on a high local
# port (127.0.0.1:8091) behind nginx, so run it as an unprivileged user.
#
# Install:
#   sudo useradd --system --home /opt/lpra --shell /usr/sbin/nologin lpra
#   sudo mkdir -p /opt/lpra /var/lib/lpra
#   sudo cp bin/lpra-server /opt/lpra/
#   sudo cp -r dist /opt/lpra/dist           # agent binaries served at /download/
#   sudo chown -R lpra:lpra /opt/lpra /var/lib/lpra
#   sudo cp deploy/lpra-server.service /etc/systemd/system/
#   sudo systemctl daemon-reload && sudo systemctl enable --now lpra-server
#
# Config overrides can go in /etc/lpra-server.env (see EnvironmentFile below),
# e.g.  LPRA_ADDR=127.0.0.1:8091
#
# Direct port forwarding (tcp/udp modes) uses port 8446 on the host — open it in
# the firewall:  ufw allow 8446/tcp ; ufw allow 8446/udp
# (The "http" forward mode and terminal/files go through nginx :8445 and need
# nothing extra.) Override with LPRA_TUNNEL_ADDR, or set it empty to disable.

[Unit]
Description=LPRA remote access host (admin panel + agent rendezvous)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=lpra
Group=lpra
WorkingDirectory=/opt/lpra

# Optional environment overrides; "-" means the file is not required.
EnvironmentFile=-/etc/lpra-server.env

ExecStart=/opt/lpra/lpra-server \
    -addr 127.0.0.1:8091 \
    -db /var/lib/lpra/lpra.db \
    -dist /opt/lpra/dist

Restart=always
RestartSec=3

# --- hardening ---
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictSUIDSGID=true
# The server only needs to write its SQLite database here.
ReadWritePaths=/var/lib/lpra

[Install]
WantedBy=multi-user.target