[Unit]
Description=second-brain transcribe worker (tower-side, faster-whisper on GPU)
Documentation=https://gitea.plantbasedsoutherner.com/petal-power/second-brain
# The worker reaches petalbrain over WireGuard, so the tunnel must be up first.
# `Wants=` is the soft form — if the tunnel disappears later the worker logs
# DB-unreachable warnings and retries, it doesn't crash-loop.
After=network-online.target wg-quick@wg-lan.service
Wants=network-online.target wg-quick@wg-lan.service

[Service]
Type=simple
User=trucktrav
Group=trucktrav

# Adjust to wherever you `git clone`d the repo on the tower.
WorkingDirectory=/opt/projects/homelab/second-brain

# Env (SECOND_BRAIN_DATABASE_URL, optional knobs). 0600, owned by herbyadmin.
EnvironmentFile=/etc/default/second-brain-transcribe

# `uv run` resolves the project venv. Keep the worker in the foreground so
# systemd owns the lifecycle; the worker handles SIGTERM/SIGINT cleanly and
# exits after the current iteration finishes.
ExecStart=/usr/bin/uv run second-brain transcribe-worker

Restart=always
RestartSec=10

# Crash loop guard — systemd will give up after this if the unit keeps
# dying. The worker itself logs+backs-off on DB outages so this only
# trips on genuine failure.
StartLimitIntervalSec=300
StartLimitBurst=5

# A few sandboxing nice-to-haves. Loose on purpose — the worker needs
# /dev/nvidia* for CUDA and writes to user-owned media/subtitles dirs.
ProtectSystem=full
ProtectHome=no
NoNewPrivileges=true

# Stdout/stderr → journald.
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target