1 files changed, 35 insertions, 0 deletions
diff --git a/packaging/systemd/meshbay-hub.service b/packaging/systemd/meshbay-hub.service
new file mode 100644
index 0000000..2bea8ea
--- /dev/null
+++ b/packaging/systemd/meshbay-hub.service
@@ -0,0 +1,35 @@
+[Unit]
+Description=MeshBay Hub — identity authority and group registry
+Documentation=https://meshbay.org/docs
+After=network-online.target postgresql.service
+Wants=network-online.target
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=meshbay
+Group=meshbay
+WorkingDirectory=/var/lib/meshbay/hub
+
+# Environment — override in /etc/meshbay/hub.env
+EnvironmentFile=-/etc/meshbay/hub.env
+Environment=MESHBAY_DATABASE_URL=postgresql+asyncpg://meshbay:CHANGEME@localhost/meshbay_hub
+Environment=MESHBAY_HUB_KEY=/etc/meshbay/hub_private.pem
+
+ExecStartPre=/usr/bin/meshbay-hub-migrate
+ExecStart=/usr/bin/meshbay-hub --config /etc/meshbay/hub.toml
+Restart=always
+RestartSec=5
+TimeoutStopSec=30
+
+# Security hardening
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/meshbay/hub /var/log/meshbay
+CapabilityBoundingSet=
+AmbientCapabilities=
+
+[Install]
+WantedBy=multi-user.target