[Service]
# Optional drop-in: apply ONLY on a box that already runs controld AND opts
# into the activator mesh (docs/planet-scale.md, mesh.go). Grants the router
# read-only access to the control token via systemd's LoadCredential — not a
# filesystem write grant. Without it, a mesh-replicated route (one that only
# ever gets a registry row on this box, never a live symlink — see
# meshreplicate.go) fails its first wake here: staging its binary needs a
# write to /opt/lchat, which this unit's own ProtectSystem=strict sandbox
# refuses, and only controld's always-unsandboxed root process can do (see
# activator.go's s3Backend.materialize, controld.go's materializeHandler).
#
# Apply:
#   cp deploy/systemd/lchat-router-control-token.conf \
#     /etc/systemd/system/lchat-router.service.d/control-token.conf
#   systemctl daemon-reload && systemctl restart lchat-router
#
# Requires /etc/lchat/control.token to already exist (controld already set
# up first) — LoadCredential fails the WHOLE unit to start if its source path
# is missing, so do not apply this on a box that doesn't run controld.
LoadCredential=control-token:/etc/lchat/control.token