[Unit]
Description=Socket for the bun install-time delivery gateway
Documentation=file:///usr/share/l.v.e-manager/docs/nodejs-bun-delivery.md

[Socket]
ListenStream=/opt/cl-bun/run/delivery.sock
# The socket guards nothing: every tenant must be able to connect. Identity
# is established inside the daemon from SO_PEERCRED, which a caller cannot
# forge, so the mode carries no security decision.
SocketMode=0666
# /opt is mounted into every cage, so the path is reachable from inside one
# without any CageFS configuration of its own.
DirectoryMode=0755

[Install]
WantedBy=sockets.target