[Unit]
# v0.2.0 — the HTTP+SSE API + React dashboard. Until now this ran as a
# hand-launched `claw-store serve` from a login shell — survived if the
# shell exited (orphaned to init), died on reboot. This unit makes the
# dashboard a first-class service that comes back the same way the
# daemon does.
Description=claw-store HTTP API + dashboard
After=network-online.target claw-store.service
Wants=network-online.target

[Service]
Type=simple
User=osobh
ExecStart=/usr/local/bin/claw-store serve --port 7700 --static-dir /usr/share/claw-store/static
Restart=on-failure
RestartSec=15
Environment=RUST_LOG=info

# Dashboard is read-mostly + shells out to the local CLI for mutations
# AND probes the peer over SSH for /api/status's peer_reachable bit.
# Notes on the sandboxing:
#   - ProtectHome was tried (with BindReadOnlyPaths=/home/osobh/.ssh)
#     but systemd blocks ALL of /home before binds run; the ssh probe
#     hits "Permission denied" on ~/.ssh/known_hosts even with the
#     bind. Re-introduce via ProtectHome=tmpfs + an explicit bind if
#     stronger sandboxing is needed later.
ProtectSystem=strict
# /var/lib/claw-store — manifest, sync queue, daemon-started file
# /hot/targets       — activate/deactivate create/remove hot target dirs
# /slab/projects     — activate/deactivate write/remove .cargo/config.toml
ReadWritePaths=/var/lib/claw-store /hot/targets /slab/projects
NoNewPrivileges=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target