[Unit]
Description=eai_agentplatform 博昇内部培训平台后端
After=network.target
Wants=network.target

[Service]
Type=simple
User=eai_agentplatform
Group=eai_agentplatform
WorkingDirectory=/opt/eai_agentplatform
EnvironmentFile=-/opt/eai_agentplatform/.env
ExecStart=/opt/eai_agentplatform/eai_agentplatform-server
Restart=always
RestartSec=3

# 交付专用设备：最小权限 + 只读加固
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/eai_agentplatform/data
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true

# 端口占用到 8080 后自动释放，方便运维
KillMode=mixed
TimeoutStopSec=30

[Install]
WantedBy=multi-user.target