[Unit]
Description=second-brain transcribe worker (tower-side, faster-whisper on GPU)
Documentation=https://gitea.plantbasedsoutherner.com/petal-power/second-brain
# The worker reaches petalbrain over WireGuard, so the tunnel must be up first.
# `Wants=` is the soft form — if the tunnel disappears later the worker logs
# DB-unreachable warnings and retries, it doesn't crash-loop.
After=network-online.target wg-quick@wg-lan.service
Wants=network-online.target wg-quick@wg-lan.service

# Crash loop guard — systemd will give up after this if the unit keeps
# dying. The worker itself logs+backs-off on DB outages so this only
# trips on genuine failure. (StartLimit* directives live in [Unit] on
# modern systemd; placing them in [Service] is a silent no-op.)
StartLimitIntervalSec=300
StartLimitBurst=5

[Service]
Type=simple
User=herbyadmin
Group=herbyadmin

# Adjust to wherever you `git clone`d the repo on the tower.
WorkingDirectory=/opt/projects/homelab/second-brain

# Env (SECOND_BRAIN_DATABASE_URL, optional knobs). 0600, owned by herbyadmin.
EnvironmentFile=/etc/default/second-brain-transcribe

# The wrapper resolves the venv's CUDA-12 lib dirs (nvidia-cublas-cu12 /
# nvidia-cudnn-cu12 pulled in by `uv sync --extra tower`), prepends them
# to LD_LIBRARY_PATH, then execs the worker via `uv run`. systemd does
# NOT inherit a shell's LD_LIBRARY_PATH, so doing this inline in the
# unit would require a brittle hard-coded `python3.XX` path and break
# on Python upgrades.
ExecStart=/opt/projects/homelab/second-brain/deploy/tower/run-transcribe-worker.sh

Restart=always
RestartSec=10

# A few sandboxing nice-to-haves. Loose on purpose — the worker needs
# /dev/nvidia* for CUDA and writes to user-owned media/subtitles dirs.
ProtectSystem=full
ProtectHome=no
NoNewPrivileges=true

# Stdout/stderr → journald.
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target