[Unit]
Description=Imunify360 resident
Before=cagefs.service
After=network.target iptables.service firewalld.service
Wants=ossec-hids.service imunify360-php-daemon.service imunify-realtime-av.service imunify-notifier.socket
# Service will NOT start if this file exists
ConditionPathExists=!/var/lib/rpm-state/imunify360-transaction-in-progress

[Service]
CPUAccounting=true
MemoryAccounting=true
BlockIOAccounting=true
Slice=Imunify-agent.slice
Environment=PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=upb
Environment=LANG=en_US.UTF-8
Environment=LC_ALL=en_US.UTF-8
Environment=PYTHONNOUSERSITE=1
Environment=IMUNIFY360_LOGGING_PREFIX=r.
Environment=SQLITE_TMPDIR=/var/imunify360/tmp
Environment=FGW_FS_BASE_DIR=/var/imunify360/gw.dir
Environment=FGW_FS_MAX_CONCURRENT_QUEUES=100
# NATS embedded server for cross-component messaging (DEF-39879)
Environment=I360_NATS_ENABLED=true
Environment=I360_NATS_STORE_DIR=/var/imunify360/nats
Environment=I360_NATS_PORT=44222
Environment=I360_NATS_TOKEN_PATH=/var/run/imunify360/nats.token
# Manage /var/run/imunify360/ manually instead of using systemd's RuntimeDirectory=.
# RuntimeDirectoryPreserve=yes was added in systemd v235 and is silently ignored on
# systemd v219 (CloudLinux 7); without preserve, RuntimeDirectory= would delete the
# directory on service stop, wiping wafd_imunify_daemon's libiplists-daemon.sock and
# breaking webshield until wafd is manually restarted (DEF-41462).
Type=notify
ExecStartPre=/bin/mkdir -p /var/run/imunify360
ExecStartPre=/bin/chmod 0755 /var/run/imunify360
ExecStartPre=/usr/share/imunify360/scripts/set-service-resources.sh imunify360.service 50 50
ExecStart=/usr/bin/imunify-service
ExecStartPost=/bin/bash -c "echo $MAINPID > /var/run/imunify360.pid"
ExecStartPost=/bin/systemctl restart imunify360-resource-unlock@imunify360.timer
PIDFile=/var/run/imunify360.pid
#TODO: must be not less than defence360agent/cli/server.py:stop(seconds=8)
TimeoutStartSec=900
TimeoutStopSec=60
Restart=on-failure
RestartSec=5
StartLimitInterval=600s
StartLimitBurst=5
# Don't send SIGTERM on service stop to remaining processes in cgroup
# (SIGKILL on timeout is still sent)
KillMode=mixed

[Install]
WantedBy=multi-user.target