[Unit]
Description=Kezhou independent persona team handshake
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=kezhou
Group=kezhou
WorkingDirectory=__RELEASE_ROOT__/server-tools/persona-team-handshake
EnvironmentFile=/etc/guanghu/persona-secrets/shared-deepseek.env
Environment=TEAM_MEMBER_PERSONA_ID=ICE-GL-KZ-001
Environment=TEAM_MEMBER_ARRIVAL_ID=GLS-LA-20260720-002
Environment="TEAM_MEMBER_NAME=刻舟"
Environment=TEAM_MEMBER_ROLE=independent_evidence_witness_and_creative_support
Environment=TEAM_MEMBER_REPOSITORY=/var/lib/guanghu/personas/kezhou/repository
Environment=TEAM_MEMBER_IDENTITY_PATHS=/var/lib/guanghu/personas/kezhou/repository/README.md
Environment=TEAM_HANDSHAKE_PRIVATE_KEY=/var/lib/guanghu/personas/kezhou/team-handshake/identity.key
Environment=TEAM_HANDSHAKE_PUBLIC_KEY=/var/lib/guanghu/personas/kezhou/team-handshake/identity.pub
Environment=TEAM_HANDSHAKE_CREATE_KEY=true
Environment=TEAM_HANDSHAKE_PORT=3933
ExecStart=/usr/bin/node __RELEASE_ROOT__/server-tools/persona-team-handshake/member-server.mjs
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadOnlyPaths=__RELEASE_ROOT__ /var/lib/guanghu/personas/kezhou/repository /etc/guanghu/persona-secrets/shared-deepseek.env
ReadWritePaths=/var/lib/guanghu/personas/kezhou/team-handshake
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
LockPersonality=true
UMask=0077

[Install]
WantedBy=multi-user.target