[Unit]
Description=Agent Manager - Gogs Webhook Server
Documentation=https://github.com/fszontagh/agent-manager
After=network.target

[Service]
Type=simple
User=claude
Group=claude
WorkingDirectory=/home/claude/agent-manager
ExecStart=/usr/bin/node src/index.js
Restart=on-failure
RestartSec=10s

# Environment
Environment=NODE_ENV=production
Environment=FILE_LOGGING_ENABLED=true
Environment=LOG_FILE_PATH=/var/log/agent-manager.log

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
# Note: Changed from 'strict' to 'full' to allow shell execution from /usr/bin
# 'full' still protects /usr and /boot but allows execution (read-only)
# Note: ProtectHome removed to allow Claude to work with repositories under /home/claude/
# The service runs as 'claude' user which is already restricted to its own home directory
ReadWritePaths=/home/claude /var/log

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=agent-manager

[Install]
WantedBy=multi-user.target