# systemd deployment (VPS)

This is the primary deployment path (docker-compose is for local dev).

```bash
sudo useradd -r -m -d /srv/cayce-ops cayce
rsync -a --exclude .venv ./ cayce@vm:/srv/cayce-ops/
sudo -u cayce uv sync --frozen
sudo -u cayce cayceops db upgrade          # alembic to head
sudo cp deploy/systemd/cayce-ops@.service deploy/systemd/cayce-ops@.timer /etc/systemd/system/

# cadence per daemon (edit OnCalendar in each timer copy):
#   scanner  hourly      executor  */10 min      maild  */5 min
#   publisher */5 min    monitor   */1 min
for d in scanner executor maild publisher monitor; do
  sudo cp deploy/systemd/cayce-ops@.timer /etc/systemd/system/cayce-ops@$d.timer
done
# adjust OnCalendar per timer, then:
sudo systemctl daemon-reload
sudo systemctl enable --now cayce-ops@{scanner,executor,maild,publisher,monitor}.timer
```

The unit hardens the daemon (NoNewPrivileges, ProtectSystem=strict) and reads
secrets only from `/srv/cayce-ops/.env` (never in the repo).