# systemd unit for the host-side hostnet agent (spec §15, FR-15.2.7).
#
# This runs ON THE DOCKER HOST — not in the container. It is the only
# component that holds the privileges to change host interface
# addresses (root or CAP_NET_ADMIN), scoped by the whitelist in its
# config file.
#
# Install:
#   sudo cp wago-sim-hostnet-agent.service /etc/systemd/system/
#   sudo cp hostnet-agent.yaml /etc/wago-sim/hostnet.yaml
#   sudo systemctl daemon-reload
#   sudo systemctl enable --now wago-sim-hostnet-agent
#
# Logs: journalctl -u wago-sim-hostnet-agent -f
#        (the agent's audit lines appear here AND on the web page)
#
# The simulator container connects through /run/wago-sim/hostnet.sock —
# docker-compose.yml mounts /run/wago-sim into the container. The
# socket is created 0660 (root:wago-sim by the directives below); put
# the container's non-root user in the same group (compose passes the
# host group via group_add).

[Unit]
Description=WAGO simulator hostnet agent (host IP settings page)
Documentation=file:///opt/wago-sim/docs/spec/software-spec.md
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
# root keeps netlink + `ip` simple; hardening still applies below.
# Alternative: a dedicated user + AmbientCapabilities=CAP_NET_ADMIN.
User=root
Environment=WAGO_SIM_HOSTNET_AGENT_CONFIG=/etc/wago-sim/hostnet.yaml
ExecStart=/opt/wago-sim/.venv/bin/wago-sim hostnet-agent \
    --config /etc/wago-sim/hostnet.yaml
Restart=on-failure
RestartSec=2

# Hardening: the agent needs network-admin on whitelisted interfaces
# and nothing else. The filesystem is locked down except for its
# config (read), socket directory and audit file (write). CAP_NET_RAW
# is included because netlink socket ops request it.
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
ReadWritePaths=/run/wago-sim /var/log/wago-sim
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW

[Install]
WantedBy=multi-user.target