[Unit]
Description=lchat cloud provisioner (self-serve space creation)
After=network-online.target lchat-control.service
Wants=network-online.target

[Service]
# /data/cloud.env holds LCHAT_ADMIN_TOKEN (gates caller-token minting),
# LCHAT_CLOUD_BASE_DOMAIN, and optional LCHAT_CLOUD_QUOTA.
EnvironmentFile=/data/cloud.env
# The control token is root-only on disk; LoadCredential hands it to this unit
# alone — a compromised instance (same lchat uid) can't read it.
LoadCredential=control-token:/etc/lchat/control.token
ExecStart=/opt/lchat/lchat cloud --socket /run/lchat/cloud.sock --db /data/cloud.db
Restart=always
RestartSec=1

# --- hardening (see docs/instance-router.md § Hardening) ---
User=lchat
Group=lchat
CapabilityBoundingSet=
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/data /run/lchat
PrivateTmp=yes
PrivateDevices=yes
ProtectClock=yes
ProtectHostname=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectProc=invisible
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
SystemCallArchitectures=native
MemoryMax=256M
TasksMax=256

[Install]
WantedBy=multi-user.target