# systemd unit template (D005) — intrusion-detection web UI.
#
# Install:
#   - Replace /path/to/intrusion-detection and the User/Group.
#   - Copy to /etc/systemd/system/ids.service
#   - sudo systemctl daemon-reload && sudo systemctl enable --now ids
#
# The app binds to 127.0.0.1:<WEB_PORT>; it must NOT be exposed to the LAN.
#
# Restart policy: automatically restart on crash. `deploy/deploy.sh` restarts
# this unit after a successful `git pull`. Scans run in a background thread, so
# one (serialized) scan at a time; deploy waits for the worker to be idle
# (see restart-service.sh) before restarting.

[Unit]
Description=Intrusion Detection web UI + IDS scanner
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
# Run as an unprivileged user; the app only needs read access to the log dirs
# it consumes (COPYPARTY_LOG_PATH / NPM_LOG_PATH) and write access to its own
# data/ + reports/ + ids.db.
User=ids
Group=ids
WorkingDirectory=/path/to/intrusion-detection
EnvironmentFile=-/etc/ids.env
ExecStart=/path/to/intrusion-detection/.venv/bin/python /path/to/intrusion-detection/app.py
Restart=on-failure
RestartSec=5

# Hardening
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ProtectHome=no
ReadWritePaths=/path/to/intrusion-detection/data /path/to/intrusion-detection/reports /var/lib/ids

[Install]
WantedBy=multi-user.target