[Unit]
Description=Panel agent (Docker runtime for game-server instances)
Documentation=https://github.com/dbledeez/panel
After=network-online.target docker.service panel-controller.service
Wants=network-online.target
Requires=docker.service

[Service]
Type=simple
# The agent user MUST be able to talk to the Docker daemon
# (member of the "docker" group, or root). install.sh handles this.
User=panel
Group=panel
SupplementaryGroups=docker
WorkingDirectory=/opt/panel
# Defaults first; /opt/panel/panel.env overrides (applied later).
Environment=PANEL_GRPC_PORT=8443
EnvironmentFile=-/opt/panel/panel.env
# Pairing (one-time cert issuance) is done by install.sh / the operator:
#   /opt/panel/bin/agent --pair-url http://localhost:8080 --pair-token <token> --cert-dir ./data/certs
ExecStart=/opt/panel/bin/agent \
    --controller localhost:${PANEL_GRPC_PORT} \
    --modules-dir ./modules \
    --data-root ./data/instances \
    --meta-dir ./data/instance-meta \
    --backup-dir ./data/backups \
    --cert-dir ./data/certs
Restart=on-failure
RestartSec=3

# Hardening is intentionally lighter than the controller's: the agent
# manages Docker containers and bind-mounts instance data, so it needs
# the docker socket and its data tree.
NoNewPrivileges=true
ProtectHome=true
ReadWritePaths=/opt/panel
PrivateTmp=true
LockPersonality=true

[Install]
WantedBy=multi-user.target