# starshipos-demo.service -- the public demo's web terminal (issue #114): ttyd on localhost, one
# throwaway StarshipOS machine per browser connection (start-session.sh). Apache in front
# (apache-demo.conf) does TLS and the websocket.
#
# Install: the repository's demo/ at /opt/starshipos-demo/demo, the saved machine (make-snapshot.sh)
# in /var/lib/starshipos-demo, a user starshipos-demo; then systemctl enable --now starshipos-demo.
[Unit]
Description=StarshipOS public demo terminal (ttyd)
After=network.target

[Service]
User=starshipos-demo
Group=starshipos-demo
Environment=DEMO_STATE=/var/lib/starshipos-demo
Environment=DEMO_SESSION_LIMIT=1800
# -m: sessions at once -- each a QEMU of about 1 GiB and most of a core (issue #116 measures it)
ExecStart=/usr/bin/ttyd --port 7681 --interface lo --writable --max-clients 3 \
    --client-option titleFixed=StarshipOS --client-option disableLeaveAlert=true \
    /opt/starshipos-demo/demo/start-session.sh
Restart=on-failure
# Each session is already a sandboxed QEMU with no network; this fences ttyd and its children too.
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ReadOnlyPaths=/var/lib/starshipos-demo
MemoryMax=4G
CPUQuota=300%
TasksMax=200

[Install]
WantedBy=multi-user.target