[Unit]
Description=CodeWhale Runtime API
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=codewhale
Group=codewhale
WorkingDirectory=/opt/whalebro
# Legacy /etc/deepseek is loaded first for old installs; /etc/codewhale wins.
EnvironmentFile=-/etc/deepseek/runtime.env
EnvironmentFile=-/etc/codewhale/runtime.env
ExecStart=/bin/sh -lc 'exec /home/codewhale/.cargo/bin/codewhale serve --http --host 127.0.0.1 --port "${CODEWHALE_RUNTIME_PORT:-${DEEPSEEK_RUNTIME_PORT:-7878}}" --workers "${CODEWHALE_RUNTIME_WORKERS:-${DEEPSEEK_RUNTIME_WORKERS:-2}}" --auth-token "${CODEWHALE_RUNTIME_TOKEN:-${DEEPSEEK_RUNTIME_TOKEN}}"'
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ReadWritePaths=/home/codewhale/.codewhale /home/codewhale/.deepseek /opt/whalebro

[Install]
WantedBy=multi-user.target