# systemd unit for the WAGO Modbus TCP simulator (bare-metal / VM).
#
# Install:
#   sudo cp wago-sim.service /etc/systemd/system/
#   sudo systemctl daemon-reload
#   sudo systemctl enable --now wago-sim
#
# Logs:   journalctl -u wago-sim -f
# Status: systemctl status wago-sim
#
# Adjust User=, WorkingDirectory= and WAGO_SIM_* to the bench setup.
# Port 502 (<1024) requires either CAP_NET_BIND_SERVICE (kept below) or a
# User with that capability; running as the dedicated non-root service
# user with AmbientCapabilities is the recommended setup.

[Unit]
Description=WAGO 750-362 Modbus TCP Simulator (PLC FAT bench)
Documentation=file:///opt/wago-sim/docs/spec/software-spec.md
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=wago-sim
Group=wago-sim
WorkingDirectory=/opt/wago-sim

# Environment config (service mode): node, bind address, port
Environment=WAGO_SIM_NODE=/opt/wago-sim/config/pump_node.yaml
Environment=WAGO_SIM_HOST=0.0.0.0
Environment=WAGO_SIM_PORT=502

ExecStart=/opt/wago-sim/.venv/bin/wago-sim serve
# SIGTERM triggers the graceful shutdown (server.stop() closes clients)
KillSignal=SIGTERM
TimeoutStopSec=10
Restart=on-failure
RestartSec=5

# Hardening
NoNewPrivileges=true
# Binding Modbus port 502 without root:
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/wago-sim/out
RestrictSUIDSGID=true

[Install]
WantedBy=multi-user.target