[Unit]
Description=semprini-core autonomous stack maintenance agent
Documentation=file:///home/paul/Dev/semprini-maintainer/README.md
After=docker.service network-online.target
Wants=network-online.target
Requires=docker.service

[Service]
Type=simple
# Runs as the host user (must be in the 'docker' group). NOT root: Claude Code
# refuses --permission-mode bypassPermissions when running as root.
User=paul
Group=paul
SupplementaryGroups=docker
WorkingDirectory=/home/paul/Dev/semprini-maintainer
Environment=HOME=/home/paul
Environment=PATH=/home/paul/.local/bin:/usr/local/bin:/usr/bin:/bin
ExecStart=/usr/bin/python3 /home/paul/Dev/semprini-maintainer/maintainer.py --config /home/paul/Dev/semprini-maintainer/config.json
Restart=always
RestartSec=30
# Give a long-running upgrade plenty of time before any stop is considered hung.
TimeoutStopSec=120

# Light hardening (kept permissive — the agent legitimately drives Docker).
NoNewPrivileges=false
StandardOutput=journal
StandardError=journal
SyslogIdentifier=semprini-maintainer

[Install]
WantedBy=multi-user.target