# Foxhunt HFT Trading Service - Core Trading Engine
# Production SystemD unit for ultra-low latency trading
# 
# INSTALLATION:
# 1. Create service user: sudo useradd -r -s /bin/false foxhunt
# 2. Copy to: sudo cp foxhunt-trading.service /etc/systemd/system/
# 3. Set permissions: sudo chmod 644 /etc/systemd/system/foxhunt-trading.service
# 4. Reload systemd: sudo systemctl daemon-reload
# 5. Enable service: sudo systemctl enable foxhunt-trading.service
#
# MANAGEMENT:
# - Start: sudo systemctl start foxhunt-trading
# - Stop: sudo systemctl stop foxhunt-trading  
# - Status: sudo systemctl status foxhunt-trading
# - Logs: sudo journalctl -u foxhunt-trading -f

[Unit]
Description=Foxhunt HFT Trading Service
Documentation=https://github.com/foxhunt/foxhunt
After=network-online.target postgresql.service
Wants=network-online.target
Requires=postgresql.service

# Service dependencies
Before=foxhunt-tli.service
PartOf=foxhunt.target

[Service]
Type=exec
ExecStart=/opt/foxhunt/bin/trading_service
ExecReload=/bin/kill -HUP $MAINPID
ExecStop=/bin/kill -TERM $MAINPID

# User and security
User=foxhunt
Group=foxhunt
DynamicUser=false

# Working directory and environment
WorkingDirectory=/opt/foxhunt
Environment=DATABASE_URL=postgresql://foxhunt:@localhost/foxhunt
Environment=RUST_LOG=info
Environment=RUST_BACKTRACE=1

# Performance optimizations for HFT
# CPU affinity - dedicate cores 0-1 for ultra-low latency
CPUAffinity=0 1
Nice=-10
IOSchedulingClass=1
IOSchedulingPriority=4

# Memory and resource limits
MemoryMax=2G
LimitNOFILE=65536
LimitNPROC=4096
LimitMEMLOCK=infinity

# Restart and reliability
Restart=always
RestartSec=5
StartLimitInterval=60
StartLimitBurst=3

# Timeout settings
TimeoutStartSec=30
TimeoutStopSec=30
TimeoutAbortSec=15

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=foxhunt-trading

# Security settings
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=false
RestrictSUIDSGID=true

# Network restrictions (gRPC on localhost only)
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
IPAddressDeny=any
IPAddressAllow=localhost
IPAddressAllow=127.0.0.1
IPAddressAllow=::1

# Filesystem access
ReadWritePaths=/opt/foxhunt/data
ReadWritePaths=/opt/foxhunt/logs
ReadWritePaths=/tmp
ReadOnlyPaths=/opt/foxhunt/bin
ReadOnlyPaths=/opt/foxhunt/config

# Process management
KillMode=mixed
KillSignal=SIGTERM

[Install]
WantedBy=multi-user.target
Also=foxhunt.target

# MONITORING RECOMMENDATIONS:
# - Monitor CPU usage on cores 0-1
# - Track memory usage (should stay under 2GB)
# - Monitor PostgreSQL connection health
# - Set up alerts for service restarts
# - Monitor trading latency metrics via logs
#
# PERFORMANCE NOTES:
# - Dedicated CPU cores 0-1 for minimal latency
# - High priority scheduling (Nice=-10)
# - Real-time IO scheduling
# - Memory lock capability for performance
# - No address space randomization for consistency