[Unit]
Description=sing-box data plane (pangolin node server)
Documentation=https://sing-box.sagernet.org
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
# Config is rendered by pangolin-agent; this unit may fail-restart until the
# agent's first Register populates /etc/sing-box/config.json — that is expected
# on a fresh box and self-heals once the agent enrolls.
ExecStart=/usr/local/bin/sing-box run -c /etc/sing-box/config.json
Restart=on-failure
RestartSec=5
LimitNOFILE=1048576
# 非特权运行;AmbientCapabilities 让 pangolin 也能绑 443(REALITY/Hy2)。
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
User=pangolin

[Install]
WantedBy=multi-user.target