🚧 WIP

deploy/wago-sim.service

@@ -0,0 +1,52 @@
+# systemd unit for the WAGO Modbus TCP simulator (bare-metal / VM).
+#
+# Install:
+#   sudo cp wago-sim.service /etc/systemd/system/
+#   sudo systemctl daemon-reload
+#   sudo systemctl enable --now wago-sim
+#
+# Logs:   journalctl -u wago-sim -f
+# Status: systemctl status wago-sim
+#
+# Adjust User=, WorkingDirectory= and WAGO_SIM_* to the bench setup.
+# Port 502 (<1024) requires either CAP_NET_BIND_SERVICE (kept below) or a
+# User with that capability; running as the dedicated non-root service
+# user with AmbientCapabilities is the recommended setup.
+
+[Unit]
+Description=WAGO 750-362 Modbus TCP Simulator (PLC FAT bench)
+Documentation=file:///opt/wago-sim/docs/spec/software-spec.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=wago-sim
+Group=wago-sim
+WorkingDirectory=/opt/wago-sim
+
+# Environment config (service mode): node, bind address, port
+Environment=WAGO_SIM_NODE=/opt/wago-sim/config/pump_node.yaml
+Environment=WAGO_SIM_HOST=0.0.0.0
+Environment=WAGO_SIM_PORT=502
+
+ExecStart=/opt/wago-sim/.venv/bin/wago-sim serve
+# SIGTERM triggers the graceful shutdown (server.stop() closes clients)
+KillSignal=SIGTERM
+TimeoutStopSec=10
+Restart=on-failure
+RestartSec=5
+
+# Hardening
+NoNewPrivileges=true
+# Binding Modbus port 502 without root:
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/wago-sim/out
+RestrictSUIDSGID=true
+
+[Install]
+WantedBy=multi-user.target