packetyeeter-analyzer.service

[Unit]
Description=PacketYeeter Analyzer - AI/ML analysis and threat intelligence
Documentation=https://github.com/awlx/packetyeeter
After=network.target

[Service]
Type=simple
# Required (not "-/etc/default/..."): native systemd does not run ExecStart
# through a shell, so it cannot fall back to inline defaults like bash's
# ${VAR:-default}. All values below must come from this file, which is
# shipped with real defaults by the package. If the file is missing, refuse
# to start rather than silently launching with empty/garbage arguments.
EnvironmentFile=/etc/default/packetyeeter-analyzer
ExecStart=/opt/packetyeeter/analyzer/packetyeeter-analyzer \
    -listen-addr ${LISTEN_ADDR} \
    -metrics-addr ${METRICS_ADDR} \
    -geoip-asn ${GEOIP_ASN_PATH} \
    ${EXTRA_ARGS}
Restart=on-failure
RestartSec=5
LimitNOFILE=65535

# Security - analyzer is userspace-only and does not need BPF capabilities.
# Keep writable state under /var/lib/packetyeeter when enabling model/cache
# files so ProtectSystem=strict can remain in place.
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/packetyeeter

[Install]
WantedBy=multi-user.target