build(pkg): systemd unit, control templates, maintainer scripts

packaging/deb/scripts/server.postinst

@@ -0,0 +1,37 @@
+#!/bin/bash
+# postinst for smartbotic-vectorapi
+set -e
+
+CONFIG_FILE="/etc/smartbotic-vectorapi/config.json"
+DATA_DIR="/var/lib/smartbotic-vectorapi"
+
+case "$1" in
+    configure)
+        if ! getent group smartbotic-vectorapi >/dev/null 2>&1; then
+            addgroup --system smartbotic-vectorapi
+        fi
+        if ! getent passwd smartbotic-vectorapi >/dev/null 2>&1; then
+            adduser --system --ingroup smartbotic-vectorapi --home "$DATA_DIR" \
+                --shell /usr/sbin/nologin --gecos "Smartbotic VectorAPI Service" smartbotic-vectorapi
+        fi
+
+        install -d -o smartbotic-vectorapi -g smartbotic-vectorapi -m 0750 "$DATA_DIR"
+        install -d -o root -g smartbotic-vectorapi -m 0750 /etc/smartbotic-vectorapi
+        if [ -f "$CONFIG_FILE" ]; then
+            chown root:smartbotic-vectorapi "$CONFIG_FILE"
+            chmod 640 "$CONFIG_FILE"
+        fi
+
+        systemctl daemon-reload || true
+        if [ -z "$2" ]; then
+            systemctl enable smartbotic-vectorapi.service || true
+            systemctl start smartbotic-vectorapi.service || true
+        else
+            systemctl reset-failed smartbotic-vectorapi.service 2>/dev/null || true
+            systemctl restart smartbotic-vectorapi.service || true
+        fi
+        ;;
+    abort-upgrade|abort-remove|abort-deconfigure) ;;
+    *) echo "postinst called with unknown argument '$1'" >&2; exit 1 ;;
+esac
+exit 0

packaging/deb/scripts/server.postrm

@@ -0,0 +1,16 @@
+#!/bin/bash
+set -e
+case "$1" in
+    purge)
+        rm -rf /var/lib/smartbotic-vectorapi
+        if getent passwd smartbotic-vectorapi >/dev/null 2>&1; then
+            deluser --system smartbotic-vectorapi 2>/dev/null || true
+        fi
+        if getent group smartbotic-vectorapi >/dev/null 2>&1; then
+            delgroup --system smartbotic-vectorapi 2>/dev/null || true
+        fi
+        ;;
+    remove|upgrade|disappear|failed-upgrade|abort-install|abort-upgrade) ;;
+esac
+systemctl daemon-reload 2>/dev/null || true
+exit 0

packaging/deb/scripts/server.prerm

@@ -0,0 +1,10 @@
+#!/bin/bash
+set -e
+case "$1" in
+    remove|deconfigure)
+        systemctl stop smartbotic-vectorapi.service 2>/dev/null || true
+        systemctl disable smartbotic-vectorapi.service 2>/dev/null || true
+        ;;
+    upgrade|failed-upgrade) ;;
+esac
+exit 0

packaging/deb/systemd/smartbotic-vectorapi.service

@@ -0,0 +1,44 @@
+[Unit]
+Description=Smartbotic VectorAPI Service
+Documentation=https://git.smartbotics.ai/fszontagh/smartbotic-vectorapi
+After=network-online.target smartbotic-database.service
+Wants=network-online.target
+
+[Service]
+# The binary calls sd_notify(READY=1) after the HTTP listener is up (when built
+# with libsystemd). Type=notify makes dependents block until we're actually
+# serving. If built without libsystemd, sd_notify is a no-op — in that case
+# change Type to "exec".
+Type=notify
+NotifyAccess=main
+User=smartbotic-vectorapi
+Group=smartbotic-vectorapi
+ExecStart=/usr/bin/smartbotic-vectorapi --config /etc/smartbotic-vectorapi/config.json
+Restart=on-failure
+RestartSec=3
+WorkingDirectory=/var/lib/smartbotic-vectorapi
+LimitNOFILE=65536
+
+# Secrets (optional): seed the admin key / OpenAI key on first boot.
+EnvironmentFile=-/etc/smartbotic-vectorapi/vectorapi.env
+
+# Security hardening (mirrors callerai-webapi). Outbound network is allowed
+# (needed for OpenAI embeddings); only writes to the data dir are permitted.
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+LockPersonality=true
+ReadWritePaths=/var/lib/smartbotic-vectorapi
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+[Install]
+WantedBy=multi-user.target

packaging/deb/templates/control.server

@@ -0,0 +1,15 @@
+Package: smartbotic-vectorapi
+Version: {{VERSION}}
+Architecture: amd64
+Maintainer: Ferenc Szontagh <ferenc.szontagh@smartbotics.ai>
+Description: Smartbotic VectorAPI — REST API for RAG vectors and JSON
+ General-purpose, client-agnostic REST API in front of smartbotic-database:
+ multi-project namespaces, multi-key per-project-grant authorization, OpenAI
+ embedding generation for RAG, similarity search, JSON document CRUD, and
+ DB-backed hot-reloaded settings. Primary client: n8n workflows.
+Homepage: https://smartbotics.ai
+Section: contrib/utils
+Priority: optional
+Depends: libsmartbotic-db-client (>= 2.3.0), libssl3t64, libsystemd0, libspdlog1.15
+Recommends: smartbotic-vectorapi-webui (= {{VERSION}})
+Installed-Size: {{INSTALLED_SIZE}}

packaging/deb/templates/control.webui

@@ -0,0 +1,13 @@
+Package: smartbotic-vectorapi-webui
+Version: {{VERSION}}
+Architecture: all
+Maintainer: Ferenc Szontagh <ferenc.szontagh@smartbotics.ai>
+Description: Smartbotic VectorAPI — web administration console
+ React-based admin console for smartbotic-vectorapi: login, project switching,
+ dashboard, collections, JSON document editor (Monaco, bundled offline), RAG
+ search tester, and project/key administration. Served by smartbotic-vectorapi.
+Homepage: https://smartbotics.ai
+Section: contrib/utils
+Priority: optional
+Depends: smartbotic-vectorapi (>= {{VERSION}})
+Installed-Size: {{INSTALLED_SIZE}}