[Unit]
Description=Harbor Desk worker (%i)
After=network-online.target docker.service
Wants=network-online.target
Requires=docker.service

[Service]
Type=simple
User=harbor
Group=harbor
EnvironmentFile=/etc/harbor/harbor.env
Environment=WORKER_ID=harbor-worker-%i
ExecStart=/opt/harbor/slots/%i/bin/worker -f /etc/harbor/gateway.yaml
Restart=on-failure
RestartSec=5
TimeoutStopSec=1800
KillSignal=SIGTERM
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/harbor
# The host has 1 vCPU; a persona-scrape job briefly saturates Chromium. Cap the
# worker so nginx/gateway keep some headroom instead of queueing behind it.
CPUQuota=70%
StandardOutput=journal
StandardError=journal
SyslogIdentifier=harbor-worker-%i

[Install]
WantedBy=multi-user.target
