# Per-user YAMS daemon, shipped by the deb, rpm and Arch packages as a
# systemd *user* unit (/usr/lib/systemd/user/yams-daemon.service).
#
# It runs as the logged-in user with the same path resolution as the CLI:
# config $XDG_CONFIG_HOME/yams/config.toml, data $XDG_DATA_HOME/yams (or the
# config's core.data_dir), socket $XDG_RUNTIME_DIR/yams-daemon.sock (or the
# config's daemon.socket_path) and log $XDG_STATE_HOME/yams/daemon.log. The
# CLI finds it without any configuration.
#
# The packages enable it for all users through the user preset
# (80-yams.preset), so it starts with each user's session. Start it now with
#   systemctl --user enable --now yams-daemon.service
# Keep it running without a login session with `loginctl enable-linger <user>`.
[Unit]
Description=YAMS daemon (per-user)
Documentation=https://github.com/trvon/yams/blob/main/docs/install.md

[Service]
Type=simple
ExecStart=/usr/bin/yams-daemon --foreground
Restart=on-failure
RestartSec=2
LimitNOFILE=16384
UMask=0077

# Light hardening only: the daemon must read the files its user adds, so the
# home directory and /tmp stay visible (no ProtectHome=, no PrivateTmp=).
NoNewPrivileges=yes
LockPersonality=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native

[Install]
WantedBy=default.target