# NVIDIA Sidecar 限流代理 — systemd service (BIZ-46 Phase3 §4)
#
# 安装：
#   sudo cp deploy/nvidia-sidecar.service /etc/systemd/system/
#   sudo systemctl daemon-reload
#   sudo systemctl enable nvidia-sidecar
#   sudo systemctl start nvidia-sidecar
#
# 运维：
#   sudo systemctl status nvidia-sidecar
#   sudo journalctl -u nvidia-sidecar -f

[Unit]
Description=NVIDIA Sidecar Rate-Limiting Proxy
Documentation=https://github.com/bizwings/nvidia-sidecar
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=sidecar
Group=sidecar
WorkingDirectory=/opt/nvidia-sidecar
ExecStart=/opt/nvidia-sidecar/.venv/bin/uvicorn nvidia_sidecar.server:app \
    --host 127.0.0.1 \
    --port 9190 \
    --log-level info
Restart=always
RestartSec=5

# 环境变量
EnvironmentFile=/opt/nvidia-sidecar/.env

# 安全加固
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/opt/nvidia-sidecar/logs

# 资源限制
LimitNOFILE=65536
MemoryMax=512M

# 启动延迟（等待网络就绪）
ExecStartPre=/bin/sleep 1

[Install]
WantedBy=multi-user.target