# Managed by pi-dictate install.sh
[Unit]
Description=Pi dictation transcription service
Requires=pi-dictate.socket
After=pipewire.service

[Service]
Type=simple
TimeoutStopSec=5s
ExecStart=%h/.local/share/pi-dictate/venv/bin/pi-dictate-service
Environment=PI_DICTATE_CONFIG_PATH=%h/.config/pi-dictate/config.json
Environment=PI_DICTATE_DEPENDENCY_PROFILE_PATH=%h/.local/share/pi-dictate/.dependency-profile
# local/offline is the fail-closed base. The installer-owned cloud drop-in
# replaces these values only after a cloud configuration and dependency profile
# have been installed.
Environment=PI_DICTATE_NETWORK_MODE=offline
Environment=PI_DICTATE_MODEL_PATH=%h/.local/share/pi-dictate/models/parakeet-tdt-0.6b-v3/parakeet-tdt-0.6b-v3.nemo
Environment=PI_DICTATE_TERMS_PATH=%h/.local/share/pi-dictate/config/coding-terms.txt
Environment=PI_DICTATE_BOOST_ALPHA=1.0
Environment=PI_DICTATE_IDLE_SECONDS=900
Environment=HF_HUB_OFFLINE=1
Environment=TRANSFORMERS_OFFLINE=1
Environment=NEMO_HOME=/tmp/pi-dictate-nemo
Environment=HF_HOME=/tmp/pi-dictate-huggingface
Environment=TRITON_CACHE_DIR=/tmp/pi-dictate-triton
Environment=NUMBA_CACHE_DIR=/tmp/pi-dictate-numba
Environment=PYTHONDONTWRITEBYTECODE=1
# Never inherit ambient proxy credentials or route audio through an unreviewed proxy.
Environment=HTTP_PROXY=
Environment=HTTPS_PROXY=
Environment=ALL_PROXY=
Environment=http_proxy=
Environment=https_proxy=
Environment=all_proxy=
UMask=0077
LimitCORE=0
MemorySwapMax=0
NoNewPrivileges=yes
PrivateTmp=yes
ProtectClock=yes
ProtectControlGroups=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectSystem=strict
ProtectHome=tmpfs
BindReadOnlyPaths=%h/.local/share/pi-dictate
BindReadOnlyPaths=%h/.local/share/uv/python
BindReadOnlyPaths=%h/.config/pi-dictate/config.json
BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.service
BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.service.d
BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.socket
BindReadOnlyPaths=%t/pipewire-0
RestrictAddressFamilies=AF_UNIX
SystemCallFilter=~bind listen
IPAddressDeny=any
LockPersonality=yes
# Refuse a service/config/dependency/network-mode or hardening mismatch before runtime code starts.
ExecStartPre=%h/.local/share/pi-dictate/venv/bin/python -c 'from pi_dictate_service.startup import validate_startup; validate_startup()'

# The socket unit owns %t/pi-dictate.sock. The service must not unlink it.