[Unit]
Description=PeerTube VOD runner with hardware and network admission
Wants=network-online.target tailscaled.service
After=network-online.target tailscaled.service
StartLimitIntervalSec=300
StartLimitBurst=10

[Service]
Type=simple
User=pt-worker
Group=pt-worker
Environment=HOME=/var/lib/pt-worker
Environment=PATH=/opt/pt-worker/node/bin:/usr/local/bin:/usr/bin:/bin
Environment=PT_STATE_DIR=/var/lib/pt-worker/state
Environment=PT_WORKER_CONFIG=/etc/pt-worker/worker.json
UMask=0077
ExecStart=/usr/bin/python3 /opt/pt-worker/pt-worker.py daemon
Restart=always
RestartSec=30
# Controller uses runner graceful-shutdown; do not send SIGTERM to FFmpeg on initial stop.
KillMode=mixed
TimeoutStopSec=infinity
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/pt-worker
PrivateTmp=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
CapabilityBoundingSet=

[Install]
WantedBy=multi-user.target