c9b9e2e5da
Unitul avea PATH explicit doar pentru CLI-ul claude din nvm. Wrapperul `infra` se leaga in ~/bin, care lipsea, deci botul nu l-ar fi gasit — stratul 4 de securitate ar fi fost prezent pe disc si inutilizabil in practica. Verificat: infra refuza un host din afara listei cu exit 3. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B29CApsP1JkSdjYaGaHpE7
62 lines
2.3 KiB
Desktop File
62 lines
2.3 KiB
Desktop File
# Unit systemd de UTILIZATOR pentru puntea Discord -> Claude Code (LXC 171).
|
|
#
|
|
# Se instaleaza in ~/.config/systemd/user/claude-discord.service (vezi install.sh).
|
|
# Rulare ca utilizatorul `claude`, NU ca root: puntea are exact accesul pe care il
|
|
# are omul la terminal — decizie de arhitectura, nu scapare (vezi README, Securitate).
|
|
#
|
|
# systemctl --user daemon-reload
|
|
# systemctl --user enable --now claude-discord
|
|
# systemctl --user status claude-discord
|
|
# journalctl --user -u claude-discord -f
|
|
|
|
[Unit]
|
|
Description=Punte Discord -> Claude Code (LXC 171 claude-agent)
|
|
Documentation=file:///workspace/romfastsql/proxmox/lxc171-claude-agent/discord-bridge/README.md
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
# Crash loop: dupa 5 porniri esuate in 300s systemd renunta si lasa unitul in
|
|
# `failed`, in loc sa se invarta la nesfarsit. Botul trimite alerta pe email
|
|
# inainte sa moara (alerts.alert_crash_loop).
|
|
StartLimitIntervalSec=300
|
|
StartLimitBurst=5
|
|
|
|
[Service]
|
|
Type=simple
|
|
WorkingDirectory=%h/.claude-discord
|
|
|
|
# Token-ul Discord si allowlist-ul stau in fisier 0600, nu in unit.
|
|
EnvironmentFile=%h/.claude-discord/env
|
|
Environment=PYTHONUNBUFFERED=1
|
|
# CLI-ul `claude` e instalat prin nvm; PATH-ul unui unit de utilizator nu-l contine.
|
|
Environment=PATH=%h/bin:%h/.nvm/versions/node/v20.19.6/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
|
|
ExecStartPre=/bin/mkdir -p %h/.claude-discord/logs
|
|
ExecStart=%h/.claude-discord/venv/bin/python /workspace/romfastsql/proxmox/lxc171-claude-agent/discord-bridge/bot.py
|
|
|
|
# ESENTIAL: la stop/restart omoara TOT cgroup-ul, nu doar procesul principal.
|
|
# Fara asta procesele `claude` (406 MB RSS masurat) raman in urma si umplu
|
|
# containerul. Nu prinde totusi ce s-a desprins din cgroup — pentru aia exista
|
|
# comanda `!cleanup` (cleanup.py).
|
|
KillMode=control-group
|
|
KillSignal=SIGTERM
|
|
TimeoutStopSec=30
|
|
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
# Backoff exponential: 5s, 10s, 20s, ... plafonat la 120s (systemd >= 254).
|
|
RestartSteps=5
|
|
RestartMaxDelaySec=120
|
|
|
|
# Containerul are istoric de OOM (incident 2026-06-24). MemoryHigh strange
|
|
# procesul prin reclaim inainte sa se ajunga la OOM-kill la MemoryMax.
|
|
MemoryHigh=3G
|
|
MemoryMax=6G
|
|
|
|
StandardOutput=append:%h/.claude-discord/logs/bot.log
|
|
StandardError=append:%h/.claude-discord/logs/bot.log
|
|
SyslogIdentifier=claude-discord
|
|
|
|
[Install]
|
|
WantedBy=default.target
|