[Unit]
Description=Thin client agent (Home Assistant MQTT control surface for Sway)
Documentation=file:///opt/thinclient-agent
# A system unit rather than a `systemctl --user` unit: the agent has to be reachable
# over MQTT whether or not a graphical session is up, and it has to survive sway
# restarting (a user unit bound to graphical-session.target would go down with it).
# The session-scoped bits it needs — SWAYSOCK, XDG_RUNTIME_DIR,
# DBUS_SESSION_BUS_ADDRESS — are derived at call time from the kiosk user's runtime
# directory in sway_control.SwayControl.session_env(), which also means they are
# re-resolved after every sway restart instead of being frozen at unit start.
#
# Deliberately NOT After=network-online.target: project-plan Phase 11.10 requires the
# thin client to boot to a usable kiosk session with the container host powered off.
After=network.target

[Service]
Type=simple
User=@KIOSK_USERNAME@
Group=@KIOSK_USERNAME@
WorkingDirectory=/opt/thinclient-agent
Environment=PYTHONPATH=/opt/thinclient-agent
Environment=PYTHONUNBUFFERED=1
EnvironmentFile=-/etc/thinclient-agent/config.env
ExecStart=/usr/bin/python3 -m thinclient_agent.main
Restart=always
RestartSec=5
# Sandboxing stops here on purpose: this unit's whole job is to spawn GUI child
# processes (Firefox, the Steam Link flatpak) that need the real /tmp, the user's
# home, and the session bus.
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target