[Unit]

Description=AstrBot Instance (%i)

After=network.target

[Service]

Type=simple

User=astrbot

Group=astrbot

# Only set what the script cannot derive from the config file.

# All XDG_*, HOME, and UV paths are computed by setup_runtime_env()

# (called inside run_astrbot before the Python process starts).

Environment="ASTRBOT_SYSTEMD=1"

Environment="ASTRBOT_DESKTOP_CLIENT=0"

# UV_CACHE_DIR is set dynamically in setup_runtime_env (per-instance under ASTRBOT_ROOT/.cache/uv).

Environment="UV_PYTHON_INSTALL_DIR=/var/cache/astrbot/python"

# Working directory: the instance root created by `astrbotctl init`.

# The script derives all per-instance paths (HOME, XDG_*, data/, etc.) from

# the instance root and the config file at /etc/astrbot/%i.conf.

WorkingDirectory=/var/lib/astrbot/%i

# astrbotctl run reads the config, sets up the full runtime environment,

# then execs into the instance's Python/uv environment.

ExecStart=/usr/bin/flock --shared --nonblock --no-fork /var/lib/astrbot/%i/.venv-maintenance.lock /usr/bin/astrbotctl __run_astrbot %i

Restart=always

RestartSec=10

# Security hardening

NoNewPrivileges=true

PrivateTmp=true

ProtectSystem=strict

ProtectHome=read-only

# AstrBot writes to the instance root (including data/, HOME, and the venv),

# and /opt/astrbot for Rust extension builds.

# BindPaths + ReadWritePaths make these writable inside the namespace.

BindPaths=/var/lib/astrbot/%i

ReadWritePaths=/opt/astrbot

ReadWritePaths=/var/cache/astrbot/python

ReadWritePaths=/var/cache/astrbot/cargo

ReadWritePaths=/var/cache/astrbot/rustup

ReadWritePaths=/var/cache/astrbot/cargo_target

[Install]

WantedBy=multi-user.target