[Unit]
Description=lchat public-web fetch service (unfurl + signed image proxy)
After=network-online.target
Wants=network-online.target

[Service]
# The service's own secrets (preview salt + image-signing key) mint themselves
# into its DB on first boot (fetch.go). The optional env file carries exactly
# one thing: LCHAT_GIPHY_KEY, the platform Giphy key that turns /api/gif on.
EnvironmentFile=-/data/fetch.env
ExecStart=/opt/lchat/lchat fetch run --socket /run/lchat/fetch.sock --db /data/fetch.db
Restart=always
RestartSec=1

# --- hardening (see docs/instance-router.md § Hardening) ---
User=lchat
Group=lchat
CapabilityBoundingSet=
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/run/lchat /data
PrivateTmp=yes
PrivateDevices=yes
ProtectClock=yes
ProtectHostname=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectProc=invisible
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
SystemCallArchitectures=native
MemoryMax=512M
TasksMax=256

[Install]
WantedBy=multi-user.target