[Unit]
Description=bun install-time delivery gateway
Documentation=file:///usr/share/l.v.e-manager/docs/nodejs-bun-delivery.md
Requires=cl-bun-deliveryd.socket
After=cl-bun-deliveryd.socket
# The store and its /run state live on local filesystems; reconciling a
# store whose device is not mounted yet would repair nothing.
After=local-fs.target

[Service]
Type=simple
PrivateTmp=yes
ProtectSystem=full
NoNewPrivileges=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
LimitNOFILE=8192
# Root is the point: the kernel refuses a hard link to a file the caller
# does not own, and the shared cache is root-owned so tenants can read it
# but never change it.
# Non-fatal on purpose: `unshare` is the only route back from a delivered
# tree (B9), so an unusable store must not keep the daemon from starting.
# Delivery itself still refuses -- it revalidates the store per transaction.
ExecStartPre=-/usr/sbin/cl-node-modules-storage reconcile
ExecStart=/opt/cloudlinux/venv/bin/python3 /usr/share/l.v.e-manager/utils/cloudlinux-bun-deliveryd.py
Restart=on-failure
RestartSec=5
# reconcile waits on the global storage lock, whose administrator timeout is
# 120 s; the start budget has to outlast that wait rather than kill it.
TimeoutStartSec=180
# Enabled delivery stays resident for its in-memory delivery budget. In the
# disabled state a socket-activated unshare exits after the request; that
# separate budget persists in root-private /run across those clean exits.
KillMode=mixed
# SIGTERM asks the daemon to cancel queued requests and finish each active
# install/swap. The finite stop budget exceeds the bounded install and rebuild
# phases plus their teardown margin.
TimeoutStopSec=2000

[Install]
WantedBy=multi-user.target