[Unit]
Description=BingShuo TCS living controller and Zhuyuan persona brain
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=bingshuo-tcs
Group=bingshuo-tcs
WorkingDirectory=__RELEASE_ROOT__/server-tools/bingshuo-tcs-controller
EnvironmentFile=/etc/guanghu/persona-secrets/shared-deepseek.env
Environment=BS_TCS_CONTROLLER_STATE_ROOT=/var/lib/guanghu/personas/bingshuo-tcs
Environment=BS_TCS_CONTROLLER_PORT=3930
ExecStart=/usr/bin/node __RELEASE_ROOT__/server-tools/bingshuo-tcs-controller/server.mjs
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadOnlyPaths=__RELEASE_ROOT__ /etc/guanghu/persona-secrets/shared-deepseek.env
ReadWritePaths=/var/lib/guanghu/personas/bingshuo-tcs
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
LockPersonality=true
UMask=0077

[Install]
WantedBy=multi-user.target