panel — open-source game server manager (public release)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/systemd/panel-agent.service

@@ -0,0 +1,41 @@
+[Unit]
+Description=Panel agent (Docker runtime for game-server instances)
+Documentation=https://github.com/dbledeez/panel
+After=network-online.target docker.service panel-controller.service
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+Type=simple
+# The agent user MUST be able to talk to the Docker daemon
+# (member of the "docker" group, or root). install.sh handles this.
+User=panel
+Group=panel
+SupplementaryGroups=docker
+WorkingDirectory=/opt/panel
+# Defaults first; /opt/panel/panel.env overrides (applied later).
+Environment=PANEL_GRPC_PORT=8443
+EnvironmentFile=-/opt/panel/panel.env
+# Pairing (one-time cert issuance) is done by install.sh / the operator:
+#   /opt/panel/bin/agent --pair-url http://localhost:8080 --pair-token <token> --cert-dir ./data/certs
+ExecStart=/opt/panel/bin/agent \
+    --controller localhost:${PANEL_GRPC_PORT} \
+    --modules-dir ./modules \
+    --data-root ./data/instances \
+    --meta-dir ./data/instance-meta \
+    --backup-dir ./data/backups \
+    --cert-dir ./data/certs
+Restart=on-failure
+RestartSec=3
+
+# Hardening is intentionally lighter than the controller's: the agent
+# manages Docker containers and bind-mounts instance data, so it needs
+# the docker socket and its data tree.
+NoNewPrivileges=true
+ProtectHome=true
+ReadWritePaths=/opt/panel
+PrivateTmp=true
+LockPersonality=true
+
+[Install]
+WantedBy=multi-user.target