[Unit]
Description=SOSP Sales Assistant Demo (mock, port 8460)
After=network.target

[Service]
Type=simple
User=sosp-assistant
Group=sosp-assistant
UMask=0077
WorkingDirectory=/var/www/demo/sosp-assistant
ExecStart=/usr/bin/flock --no-fork --nonblock /var/www/demo/sosp-assistant/data/server.lock /usr/bin/node --experimental-sqlite server.js
Environment=NODE_ENV=production
Environment=HOME=/var/lib/sosp-assistant
Environment=PORT=8460
Environment=HOST=127.0.0.1
Environment=SOSP_MODE=mock
# 本机私密运行配置，权限 0600；缺失时拒绝启动
EnvironmentFile=/etc/sosp-assistant/access.env
EnvironmentFile=/etc/sosp-assistant/xfyun.env
# 可选：生产只读参考查询（默认关闭）
Environment=SOSP_ENABLE_SF_READONLY=false
# UAT 写入开关默认关闭；未通过组织身份核验前写入一律拒绝
Environment=SOSP_UAT_WRITE=false
Restart=on-failure
RestartSec=3
KillMode=mixed
# 内存约束：应用本体很小；AI 隔离实例按需拉起并空闲自动停止
MemoryHigh=600M
MemoryMax=900M
NoNewPrivileges=true
CapabilityBoundingSet=
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectSystem=strict
ReadWritePaths=/var/www/demo/sosp-assistant/data
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target