# systemd unit for the Bloom engine runner (M17-4), installed on the worker VM as
# /etc/systemd/system/bloom-engine-runner.service by deploy/engine-runner/deploy.sh.
#
# Secrets live in the EnvironmentFile (0600, owner-only): the service bearer token and the
# Claude subscription OAuth token. ANTHROPIC_API_KEY must never appear there - the runner's
# /health reports its absence as a check.
[Unit]
Description=Bloom engine runner (Claude Code execution worker)
After=network-online.target tailscaled.service
Wants=network-online.target

[Service]
Type=simple
User=exedev
WorkingDirectory=/home/exedev/bloom-engine-runner/apps/server
EnvironmentFile=/home/exedev/.config/bloom-engine/runner.env
ExecStart=/usr/bin/env node /home/exedev/bloom-engine-runner/apps/server/dist/engine_runner/main.cjs
# ~/.local/bin stays on PATH so the runner can spawn the user-installed claude binary.
Environment=PATH=/home/exedev/.local/bin:/usr/local/bin:/usr/bin:/bin
Restart=on-failure
RestartSec=5
# The engine executes generated code; keep the unit's own surface small.
NoNewPrivileges=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target