[Unit]
Description=Lemonade Server
After=network-online.target

[Service]
Type=simple
User=lemonade
Group=lemonade
WorkingDirectory=@CMAKE_INSTALL_FULL_LOCALSTATEDIR@/lib/lemonade
# Server settings (port, host, models_dir, …) live in config.json, not env vars.
# The env-file drop-in is kept for the few env vars lemond still reads:
#   HF_TOKEN                 — HuggingFace authentication token
#   LEMONADE_API_KEY         — require API-key auth on all routes
#   LEMONADE_ADMIN_API_KEY   — API-key specific to internal routes
EnvironmentFile=-/etc/lemonade/conf.d/*.conf
ExecStart=@CMAKE_INSTALL_FULL_BINDIR@/lemond
Restart=on-failure
RestartSec=5s
KillSignal=SIGINT
AmbientCapabilities=CAP_SYS_RESOURCE

# Security hardening
PrivateTmp=yes
NoNewPrivileges=yes
ProtectSystem=full
ProtectHome=yes
ReadWritePaths=@CMAKE_INSTALL_FULL_LOCALSTATEDIR@/lib/lemonade
RestrictRealtime=yes
RestrictNamespaces=yes
LockPersonality=yes

[Install]
WantedBy=multi-user.target
