[Unit]
Description=EasyAI AI Gateway Gitea Actions runner
After=network-online.target docker.service
Wants=network-online.target docker.service

[Service]
Type=simple
User=easyai-gateway-runner
Group=easyai-gateway-runner
WorkingDirectory=/var/lib/easyai-gateway-runner
Environment=HOME=/var/lib/easyai-gateway-runner
Environment=PATH=/opt/easyai-gateway-ci/bin:/opt/easyai-gateway-ci/toolchains/go/bin:/opt/easyai-gateway-ci/toolchains/node/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# Gitea 1.22 can leave a long-running poll stale after a completed host job.
# Process exactly one job, then let Restart=always create a fresh poller.
ExecStart=/opt/easyai-gateway-ci/bin/gitea-runner --config /etc/easyai-gateway-runner/config.yaml daemon --once
Restart=always
RestartSec=5s
TimeoutStopSec=330s
# Tag jobs invoke one SHA-validating root helper. Docker access already gives
# this dedicated repository runner an equivalent host-root trust boundary.
NoNewPrivileges=false
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
ReadWritePaths=/var/lib/easyai-gateway-runner

[Install]
WantedBy=multi-user.target