[Unit]
Description=Pangolin control plane (HTTP API + gRPC agent server)
Documentation=https://github.com/wangjia/pangolin
After=network-online.target redis-server.service
Wants=network-online.target redis-server.service

[Service]
Type=simple
EnvironmentFile=/etc/pangolin/server.env
ExecStart=/usr/local/bin/pangolin-server
Restart=on-failure
RestartSec=3
# Control plane holds JWT/CA keys; keep them owner-only. Runs unprivileged.
UMask=0077
User=pangolin

[Install]
WantedBy=multi-user.target