# systemd unit for the @dgb-wallet/p2p HTTP daemon on a wallet VPS.
# Ships with digibyte.x — Caddy reverse-proxies /p2p/ here.
#
# Prereqs (all provisioned by ops/deploy-wallet.sh):
#   - /opt/dgb-wallet/  contains the monorepo checkout (or at minimum
#                       packages/{core,p2p,net}/ + workspace root)
#   - Node 20+ installed as /usr/bin/node
#   - `npm install` already run at /opt/dgb-wallet/ so node_modules
#     is populated
#   - dgb-wallet user owns /opt/dgb-wallet and /var/lib/dgb-wallet
#
# The daemon binds 127.0.0.1:5174 only. It is NOT reachable from the
# public internet directly; Caddy on 443 fronts it via /p2p/*.

[Unit]
Description=DigiByte.X Wallet P2P Daemon (BIP157/158 SPV + broadcast)
Documentation=https://digibyte.x
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=dgb-wallet
Group=dgb-wallet
WorkingDirectory=/opt/dgb-wallet

# 8 GB heap ceiling — the header chain (~7.8M entries × 80 B + JS
# overhead) sits around 3-4 GB in steady state; leave headroom for
# scan bursts. Match packages/p2p/package.json's daemon script.
Environment="NODE_OPTIONS=--max-old-space-size=8192"

ExecStart=/usr/bin/node --import tsx/esm packages/p2p/bin/dgb-daemon.ts
Restart=on-failure
RestartSec=5s

# Hardening — daemon reads/writes only its data dir and its checkout.
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
ReadWritePaths=/var/lib/dgb-wallet
Environment="APPDATA=/var/lib/dgb-wallet"

# Kill on OOM rather than let systemd escalate to the whole slice.
OOMScoreAdjust=500

# Journal so `journalctl -u dgb-daemon -f` shows peer connect/disconnect
# and scan telemetry.
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target