[Unit]
# systemd unit for the SCIM->NexusCRM bridge (services/scim-bridge).
# The bridge is a single self-contained stdlib file; install it to a system
# location owned by the service user (see ./README.md) rather than running it
# from an operator checkout under /home, so a dedicated service account can
# always read/execute it. `systemctl daemon-reload` then
# `systemctl enable --now nexuscrm-scim-bridge`.
Description=NexusCRM SCIM identity-sync bridge (Helix SCIM 2.0 -> NexusCRM REST)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
# Non-root service account that owns the installed program, config, and state.
User=nexuscrm-scim-bridge
Group=nexuscrm-scim-bridge
WorkingDirectory=/opt/nexuscrm-scim-bridge
# Config file (mode 0600, chown nexuscrm-scim-bridge). No secrets in the unit.
EnvironmentFile=/etc/nexuscrm-scim-bridge/scim-bridge.env
ExecStart=/usr/bin/python3 /opt/nexuscrm-scim-bridge/scim_bridge.py
Restart=on-failure
RestartSec=5
# The breaker budget persists here across restarts; keep one instance per file.
StateDirectory=nexuscrm-scim-bridge
Environment=BRIDGE_STATE_FILE=/var/lib/nexuscrm-scim-bridge/state.json
# Hardening: no privileges, no home access, read-only system, private tmp.
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target