[Unit]
Description=HAN Chat VM1 host telemetry collector (%i)
Requires=han-secrets@%i.service
After=docker.service han-secrets@%i.service network-online.target
Wants=docker.service network-online.target
ConditionPathIsExecutable=/usr/local/bin/otelcol-contrib
ConditionPathIsDirectory=/opt/han-chat/current/backend

[Service]
Type=simple
User=root
Group=root
EnvironmentFile=/etc/han/vm1.env
ExecStartPre=/usr/local/bin/otelcol-contrib validate --config=/opt/han-chat/current/backend/deployment/observability/otel-host-collector.yaml
ExecStart=/usr/local/bin/otelcol-contrib --config=/opt/han-chat/current/backend/deployment/observability/otel-host-collector.yaml
Restart=on-failure
RestartSec=10s
TimeoutStopSec=30
UMask=0077
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
CapabilityBoundingSet=
AmbientCapabilities=
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
ReadOnlyPaths=/opt/han-chat/current/backend/deployment/observability
ReadOnlyPaths=/var/lib/docker/containers
ReadOnlyPaths=/var/log/journal
ReadOnlyPaths=/run/log/journal
ReadOnlyPaths=/run/han-chat/secrets
ReadWritePaths=/var/lib/han-otel/host-collector
LimitCORE=0
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target