[Unit]
Description=Fleet Forge Agent - Endpoint Management Agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=root
Group=root
ExecStart=/usr/local/bin/forge-agent run
Restart=on-failure
RestartSec=10
StartLimitIntervalSec=300
StartLimitBurst=5

Environment=FORGE_API_URL=http://localhost:3000

StandardOutput=journal
StandardError=journal
SyslogIdentifier=forge-agent

NoNewPrivileges=false
ProtectSystem=strict
ReadWritePaths=/etc/forge-agent /var/lib/forge-agent
ProtectHome=true
PrivateTmp=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
RestrictSUIDSGID=true
RestrictNamespaces=true
LockPersonality=true
MemoryDenyWriteExecute=false

[Install]
WantedBy=multi-user.target