# @kard/agent — systemd unit
#
# Install:
#   1. Copy this file to /etc/systemd/system/kard.service
#   2. Edit the User= and EnvironmentFile= paths to match your machine.
#   3. systemctl daemon-reload
#   4. systemctl enable --now kard
#   5. journalctl -u kard -f      ← live logs
#
# Auto-restarts on crash. Boots on machine reboot. Runs the daemon mode
# which auto-attaches every chat adapter that has a token in the env file.

[Unit]
Description=Kard agentic-trading runtime
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=kard
Group=kard
WorkingDirectory=/home/kard/kard

# All sensitive vars (LLM keys, KARD_PASSWORD, chat tokens) live here.
# chmod 600 /home/kard/.kard/env
EnvironmentFile=/home/kard/.kard/env

ExecStart=/usr/bin/node /home/kard/kard/src/cli/index.js daemon

# Restart policy — back off on rapid crashes (e.g. RPC down), then keep trying
Restart=always
RestartSec=10
StartLimitBurst=10
StartLimitIntervalSec=300

# Logs to journal
StandardOutput=journal
StandardError=journal
SyslogIdentifier=kard

# Hardening — kard never needs root, network only outbound
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/home/kard/.kard
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictRealtime=true
RestrictSUIDSGID=true

# Resource caps — adjust based on how many fleet agents you run
LimitNOFILE=65536
MemoryMax=2G

[Install]
WantedBy=multi-user.target