[Unit]
Description=Hermes Service - AI Agent HTTP API
After=network.target

[Service]
Type=simple
User=hermesai
Group=hermesai
WorkingDirectory=/d/hermesai/repos/hermes-service
ExecStart=/usr/bin/python3 /d/hermesai/repos/hermes-service/main.py
Restart=always
RestartSec=5
StandardOutput=journal
StandardError=journal

# Environment
Environment="HOME=/d/hermesai"
Environment="PYTHONUNBUFFERED=1"

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/d/hermesai/users /d/hermesai/repos/hermes-service/data

[Install]
WantedBy=multi-user.target