# Example unit for a supervised omp-conductor daemon.
#
# Why MemoryMax exists: worker and orchestrator sessions are child processes of
# this service and stay inside its cgroup, so MemoryMax governs the whole
# fleet's footprint rather than one process. With the default two workers plus
# the orchestrator session, journald on a reference 7.6 GB host recorded Memory
# peaks of ~3.2–4.2 GB for this unit (issue #51). That is expected load, not a
# leak — and on a shared VPS it is enough to thrash swap or OOM the daemon
# mid-flight (orphan path).
#
# Before enabling:
#   1. Set User=/Group=/HOME=/PATH for the account that owns ~/.omp/conductor.
#   2. Point ExecStart at the omp-conductor binary on that host.
#   3. On hosts under ~16 GiB RAM, prefer maxConcurrentWorkers=1 in config and
#      consider MemoryMax=3G.
#   4. Do not co-locate ClickHouse + other multi-GB services beside a 2-worker
#      fleet on a ≤8 GB box.
#
# OnFailure (issue #485): this line arms the fleet recovery oneshot that #485
# ships via `setup host` — `omp-conductor-recover.service`, staged from
# omp-conductor-recover.sh. Do not remove it: a crash-looped unit used to sit in
# `failed` indefinitely with nobody watching it. Re-running `setup host`
# provisions the recovery unit and installs the playbook itself.
#
# Install:
#   sudo install -m 0644 omp-conductor.service.example /etc/systemd/system/omp-conductor.service
#   sudo systemctl daemon-reload
#   sudo systemctl enable omp-conductor.service
#   sudo systemctl restart omp-conductor.service

[Unit]
Description=omp-conductor dispatch daemon
Documentation=https://github.com/TerrifiedBug/conductor
After=network-online.target
Wants=network-online.target
OnFailure=omp-conductor-recover.service

[Service]
Type=simple
# REPLACE: the account that owns ~/.omp/conductor and the gh auth the tracker uses.
User=fleet
Group=fleet
Environment=HOME=/home/fleet
# systemd's default PATH has no user installs; include wherever `omp`,
# `omp-conductor` and `gh` live on this host.
Environment=PATH=/home/fleet/.local/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin

WorkingDirectory=/home/fleet

# Foreground daemon so systemd tracks MainPID. `omp-conductor start` backgrounds;
# under a unit, call `daemon` directly.
ExecStart=/home/fleet/.local/bin/omp-conductor daemon --port 8787

Restart=always
# Restart on any exit — clean, signalled or crashed — except an explicit
# `systemctl stop`, which systemd records as intentional and never undoes
# (issue #546). A stray SIGTERM (e.g. a worker's `bun test`) then costs
# seconds of downtime instead of leaving the fleet down until a human;
# a crash loop still trips the start-limit burst and reaches OnFailure above.
# SuccessExitStatus=0 143 keeps a handled SIGTERM shutdown logged as success.
SuccessExitStatus=0 143

MemoryAccounting=yes
# Hard ceiling just above measured 2-worker peaks. Crossing it cgroups-OOMs the
# unit — prefer lowering maxConcurrentWorkers before raising this.
MemoryMax=5G

[Install]
WantedBy=multi-user.target