# Quantus Planck node, validator role, external-miner mode.
#
# Hardened per ~/git/architecture/generic.md §8. Two knobs are deliberately
# relaxed; both are load-bearing, do not "tidy" them back:
#
#   MemoryDenyWriteExecute=false
#     Substrate JITs the on-chain wasm runtime through wasmtime and needs W|X
#     pages. With this true the node aborts during block import.
#
#   Type=simple (not notify)
#     quantus-node does not sd_notify(READY=1). Type=notify would block
#     `systemctl restart` until TimeoutStartSec expires
#     (deployment-gitea-actions.md §6).
#
# The reward preimage arrives via EnvironmentFile because the node exposes no
# environment-variable form for any flag (`--help` carries no `[env:]`
# annotations), so it must be a CLI argument. The EnvironmentFile keeps it out
# of this world-readable unit; it is still visible in `ps` to a local user on
# the host, which is accepted on a single-tenant box.

[Unit]
Description=Quantus node (Planck, validator, external-miner mode)
Documentation=https://github.com/Quantus-Network/chain
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=quantus-node
Group=quantus-node
Environment=RUST_LOG=info
EnvironmentFile=/etc/quantus-node/node.env
WorkingDirectory=/var/lib/quantus-node

ExecStart=/usr/local/bin/quantus-node \
    --validator \
    --chain planck \
    --name %H \
    --base-path /var/lib/quantus-node \
    --node-key-file /var/lib/quantus-node/node_key.p2p \
    --rewards-inner-hash ${QUANTUS_INNER_HASH} \
    --miner-listen-port 9833 \
    --port 30333 \
    --prometheus-port 9615 \
    --max-blocks-per-request 64 \
    --sync full

Restart=always
RestartSec=10s
# RocksDB needs time to flush cleanly; a SIGKILL mid-compaction means a slow
# (or corrupt) recovery on next start.
TimeoutStopSec=300
KillSignal=SIGINT
LimitNOFILE=65536

NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
SystemCallArchitectures=native
MemoryDenyWriteExecute=false

ReadWritePaths=/var/lib/quantus-node
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6

[Install]
WantedBy=multi-user.target