# move-detect edge daemon — systemd unit (Raspberry Pi 5, air-gapped/폐쇄망).
# Install: copy to /etc/systemd/system/, fill /etc/move-detect/edge.env, then
#   sudo systemctl daemon-reload && sudo systemctl enable --now move-detect-edge
# The daemon tolerates the cloud being offline (events buffer in the local queue
# and flush on reconnect), so this unit only *wants* the network, not requires it.

[Unit]
Description=move-detect edge daemon (workplace-safety AI CCTV)
Documentation=file:/opt/move-detect/docs/pilot-runbook.md
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
# Dedicated unprivileged account; must be in the groups that own the camera and
# the Hailo accelerator device nodes.
User=movedetect
Group=movedetect
SupplementaryGroups=video render plugdev

WorkingDirectory=/opt/move-detect
EnvironmentFile=/etc/move-detect/edge.env
# Run the package straight from source (no pip build step needed offline).
Environment=PYTHONPATH=/opt/move-detect/src
ExecStart=/opt/move-detect/venv/bin/python -m edge

# Unattended resilience: always restart; the loop also isolates per-frame and
# periodic-op exceptions internally so a single glitch never exits the process.
Restart=always
RestartSec=5
StartLimitIntervalSec=0

# Writable state (offline queue sqlite lives here; keep QUEUE_DB pointed at it).
# systemd creates/owns /var/lib/move-detect for the service user.
StateDirectory=move-detect
StateDirectoryMode=0750

# Camera + accelerator device access (USB UVC = /dev/video*, Hailo = /dev/hailo0).
DeviceAllow=/dev/hailo0 rw
DeviceAllow=char-video4linux rw

# Conservative hardening (loosen if it blocks device access on your image).
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/var/lib/move-detect
ProtectHome=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target