[Unit]
Description=Michka monitor agent (pushes local metrics to a hub)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=michka
Group=michka
# Settings live in /etc/default/michka-agent (MICHKA_ARGS). At minimum it must set --hub.
EnvironmentFile=-/etc/default/michka-agent
# The self-contained binary unpacks bundled native libs to a cache dir at startup. It MUST sit on an
# exec-mounted filesystem: /run is a tmpfs frequently mounted noexec, which makes dlopen() of the
# unpacked native libs (e_sqlite3) fail with "failed to map segment from shared object" and the agent
# crash-loops. StateDirectory gives a writable /var/lib/michka-agent that is whitelisted even under
# ProtectSystem=strict and lives on an exec filesystem, so extract there.
StateDirectory=michka-agent
Environment=DOTNET_BUNDLE_EXTRACT_BASE_DIR=/var/lib/michka-agent/.bundle
ExecStart=/opt/michka/michka_c --agent $MICHKA_ARGS
Restart=always
RestartSec=5
# The agent only reads /proc + /sys and pushes over the network — lock everything else down.
NoNewPrivileges=true
ProtectHome=true
ProtectSystem=strict
ProtectKernelTunables=true
ProtectControlGroups=true

[Install]
WantedBy=multi-user.target
