# punktfunk management web console — systemd USER unit (Nitro SSR on bun, port 47992, HTTPS).
#
# Installed by the punktfunk-web .deb to /usr/lib/systemd/user/. AUTO-WIRED — no env editing:
# it sources the host's mgmt token + the generated login password, serves HTTPS (HTTP/1.1 over TLS)
# with the host's own identity cert (~/.config/punktfunk/{cert,key}.pem), and points the /api proxy
# at the host's loopback HTTPS mgmt API. The self-signed cert is accepted only for that loopback hop,
# scoped inside the proxy code (Bun per-request TLS) — no process-wide NODE_TLS_REJECT_UNAUTHORIZED.
# Enable per user:
#   systemctl --user enable --now punktfunk-web
[Unit]
Description=punktfunk management web console
# web-init generates the login password; the host writes the mgmt token. Order after both.
After=punktfunk-web-init.service punktfunk-host.service
Wants=punktfunk-web-init.service
# Retry indefinitely while the host is still writing the mgmt token + identity cert. Without this,
# systemd's default rate limit (5 starts / 10 s) plus RestartSec=2 gives up permanently after ~10 s
# - so a console enabled before the host's first run stayed dead until someone restarted it by hand
# (the same defect the Windows PunktfunkWeb task had).
StartLimitIntervalSec=0

[Service]
Type=simple
# Both are KEY=VALUE files. mgmt-token is REQUIRED (written by the host's `serve`); if absent the
# unit fails + Restart retries until the host has created it. web-password is '-' optional (web-init
# creates it first, but a manual operator may inject PUNKTFUNK_UI_PASSWORD another way).
EnvironmentFile=%h/.config/punktfunk/mgmt-token
EnvironmentFile=-%h/.config/punktfunk/web-password
# The host's ACTUAL mgmt port: `serve` writes this file (mgmt::publish_endpoint) with the port it
# really bound, so moving the listener — the fix for sharing a box with a Sunshine fork, which owns
# 47990 as its web UI — needs no edit here. Optional ('-'): an older host never wrote it, and the
# server's own built-in default (https://127.0.0.1:47990, util/auth.ts) then applies unchanged.
#
# Deliberately NOT paired with an `Environment=PUNKTFUNK_MGMT_URL=` default line: whether a file or
# an Environment= assignment wins is a question of directive order, and the answer differs between
# this hand-written unit and the one the NixOS module generates. One source, no precedence puzzle.
EnvironmentFile=-%h/.config/punktfunk/mgmt-endpoint
Environment=PORT=47992
Environment=HOST=0.0.0.0
# Serve HTTPS (HTTP/1.1 over TLS) with the host's own identity cert; mark the
# session cookie Secure. The host's `serve` writes these PEMs; if absent at start the unit fails and
# Restart retries (same as the mgmt-token wait above) rather than silently serving plain HTTP.
Environment=PUNKTFUNK_UI_TLS_CERT=%h/.config/punktfunk/cert.pem
Environment=PUNKTFUNK_UI_TLS_KEY=%h/.config/punktfunk/key.pem
Environment=PUNKTFUNK_UI_SECURE=1
ExecStart=/usr/bin/punktfunk-web-server
# `always`, not `on-failure`: a console that exits 0 has still stopped serving, and on-failure would
# leave it down. An explicit `systemctl --user stop` is still honoured (Restart= never fights that).
# Windows parity: web-run.cmd likewise relaunches bun on ANY exit.
Restart=always
RestartSec=2

[Install]
WantedBy=default.target