2 files changed, 64 insertions, 0 deletions
diff --git a/packaging/systemd/meshbay-hub.service b/packaging/systemd/meshbay-hub.service
new file mode 100644
index 0000000..2bea8ea
--- /dev/null
+++ b/packaging/systemd/meshbay-hub.service
@@ -0,0 +1,35 @@
+[Unit]
+Description=MeshBay Hub — identity authority and group registry
+Documentation=https://meshbay.org/docs
+After=network-online.target postgresql.service
+Wants=network-online.target
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=meshbay
+Group=meshbay
+WorkingDirectory=/var/lib/meshbay/hub
+
+# Environment — override in /etc/meshbay/hub.env
+EnvironmentFile=-/etc/meshbay/hub.env
+Environment=MESHBAY_DATABASE_URL=postgresql+asyncpg://meshbay:CHANGEME@localhost/meshbay_hub
+Environment=MESHBAY_HUB_KEY=/etc/meshbay/hub_private.pem
+
+ExecStartPre=/usr/bin/meshbay-hub-migrate
+ExecStart=/usr/bin/meshbay-hub --config /etc/meshbay/hub.toml
+Restart=always
+RestartSec=5
+TimeoutStopSec=30
+
+# Security hardening
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/meshbay/hub /var/log/meshbay
+CapabilityBoundingSet=
+AmbientCapabilities=
+
+[Install]
+WantedBy=multi-user.target
diff --git a/packaging/systemd/meshbay-node.service b/packaging/systemd/meshbay-node.service
new file mode 100644
index 0000000..e64934f
--- /dev/null
+++ b/packaging/systemd/meshbay-node.service
@@ -0,0 +1,29 @@
+[Unit]
+Description=MeshBay Node — local file host and streaming server
+Documentation=https://meshbay.org/docs
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=%i
+Group=%i
+
+# Per-user service: systemctl enable --now meshbay-node@$USER
+WorkingDirectory=%h
+
+# Override unlock mode in ~/.config/meshbay/hub.env
+EnvironmentFile=-%h/.config/meshbay/node.env
+# Alternative: MESHBAY_UNLOCK_KEY=<password> in environment file (chmod 600)
+
+ExecStart=/usr/bin/meshbay-node --config %h/.config/meshbay/node.toml
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=30
+
+# Security hardening
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=default.target