# Systemd user unit for the holger-server behind the console's prod chain
# (tailscale serve → nginx `holger-console` quadlet → this server).
#
# Install: cp deploy/holger-server.service ~/.config/systemd/user/
# systemctl --user daemon-reload
# systemctl --user enable --now holger-server
# Logs: journalctl --user -u holger-server
#
# Expects:
# %h/.local/bin/holger-server — the release binary
# (cargo build --release -p holger-server-cli,
# then cp target/release/holger-server ~/.local/bin/)
# %h/.config/holger-console/server.ron — the RON graph (no inline secrets)
# %h/.config/holger-console/token — the bearer secret, chmod 600
# %h/.local/share/holger-console/store — the data root the RON names
#
# `loginctl enable-linger` once, so the service starts at boot and survives
# logout (already required by the nginx quadlet beside it).
[Unit]
Description=holger artifact server (console prod backend, gRPC-web on 50051)
Wants=network-online.target
After=network-online.target
[Service]
ExecStart=%h/.local/bin/holger-server start --config %h/.config/holger-console/server.ron
Restart=on-failure
RestartSec=3
# The server is loopback-only (tailscale + nginx own the exposure); keep the
# process's own surface tight too.
NoNewPrivileges=true
[Install]
WantedBy=default.target