# Foxhunt HFT TLI Service - Terminal Interface Client
# Production SystemD unit for trading terminal interface
#
# INSTALLATION:
# 1. Ensure service user exists: sudo useradd -r -s /bin/false foxhunt
# 2. Copy to: sudo cp foxhunt-tli.service /etc/systemd/system/
# 3. Set permissions: sudo chmod 644 /etc/systemd/system/foxhunt-tli.service
# 4. Reload systemd: sudo systemctl daemon-reload
# 5. Enable service: sudo systemctl enable foxhunt-tli.service
#
# MANAGEMENT:
# - Start: sudo systemctl start foxhunt-tli
# - Stop: sudo systemctl stop foxhunt-tli
# - Status: sudo systemctl status foxhunt-tli
# - Logs: sudo journalctl -u foxhunt-tli -f

[Unit]
Description=Foxhunt HFT Terminal Interface (TLI)
Documentation=https://github.com/foxhunt/foxhunt
After=network-online.target foxhunt-trading.service foxhunt-backtesting.service
Wants=network-online.target
Requires=foxhunt-trading.service foxhunt-backtesting.service

# Service dependencies
PartOf=foxhunt.target

[Service]
Type=exec
ExecStart=/opt/foxhunt/bin/tli
ExecReload=/bin/kill -HUP $MAINPID
ExecStop=/bin/kill -TERM $MAINPID

# User and security
User=foxhunt
Group=foxhunt
DynamicUser=false

# Working directory and environment
WorkingDirectory=/opt/foxhunt
Environment=RUST_LOG=info
Environment=RUST_BACKTRACE=1
Environment=TRADING_SERVICE_URL=http://127.0.0.1:8080
Environment=BACKTESTING_SERVICE_URL=http://127.0.0.1:8081

# Performance optimizations
# CPU affinity - cores 4-5 for UI responsiveness
CPUAffinity=4 5
Nice=5
IOSchedulingClass=2
IOSchedulingPriority=5

# Memory and resource limits
MemoryMax=1G
LimitNOFILE=65536
LimitNPROC=2048

# Restart and reliability
Restart=on-failure
RestartSec=10
StartLimitInterval=300
StartLimitBurst=5

# Timeout settings
TimeoutStartSec=30
TimeoutStopSec=15
TimeoutAbortSec=10

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=foxhunt-tli

# Security settings
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=true
RestrictSUIDSGID=true

# Network restrictions (gRPC client to localhost services only)
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
IPAddressDeny=any
IPAddressAllow=localhost
IPAddressAllow=127.0.0.1
IPAddressAllow=::1

# Filesystem access
ReadWritePaths=/opt/foxhunt/tli_config
ReadWritePaths=/opt/foxhunt/logs
ReadWritePaths=/tmp
ReadOnlyPaths=/opt/foxhunt/bin
ReadOnlyPaths=/opt/foxhunt/config

# Process management
KillMode=mixed
KillSignal=SIGTERM

[Install]
WantedBy=multi-user.target
Also=foxhunt.target

# MONITORING RECOMMENDATIONS:
# - Monitor gRPC connection health to trading/backtesting services
# - Track UI responsiveness metrics
# - Monitor memory usage (should stay under 1GB)
# - Set up alerts for connection failures
# - Track user session activity
#
# PERFORMANCE NOTES:
# - Dedicated CPU cores 4-5 for UI responsiveness
# - Lower priority (Nice=5) - not latency critical
# - Restart on failure only (not critical for system operation)
# - Lower memory limit - primarily a client interface
# - Extended start limit for network dependency handling