Artifacts

[Unit]
Description=HQ01 — AAF Holdings operating system (Next.js, host-served)
After=network.target docker.service
Wants=network-online.target

[Service]
Type=simple
User=ed
Group=ed
WorkingDirectory=/srv/aaf/repositories/aaf-holdings/hq01
Environment=NODE_ENV=production
Environment=PORT=4000
Environment=HQ01_CONTENT_ROOT=/srv/aaf
# Controlled permission posture for dispatched Claude sessions (acceptEdits +
# scoped tool allowlist; never bypassPermissions, no Bash → no arbitrary shell).
Environment=HQ01_CLAUDE_PERMISSION_MODE=acceptEdits
Environment=HQ01_CLAUDE_ALLOWED_TOOLS=Read,Write,Edit,LS
# Bind all interfaces so the traefik container can reach it via host-gateway.
ExecStart=/usr/bin/node node_modules/next/dist/bin/next start -p 4000 -H 0.0.0.0
Restart=on-failure
RestartSec=3

[Install]
WantedBy=multi-user.target