[Unit]
Description=Local CI/CD — destroy orphaned build VMs (max age 6h)
Documentation=file:///opt/ci/local-ci-cd-system/deploy/systemd/README.md
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
User=ci-runner
Group=ci-runner
EnvironmentFile=/etc/ci/environment
ExecStart=/opt/ci/venv/bin/python -m ci_orchestrator vm cleanup --max-age-hours 6
TimeoutStartSec=1h
Nice=10
# Hardening
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
NoNewPrivileges=true
ReadWritePaths=/var/lib/ci /var/log/ci

[Install]
WantedBy=multi-user.target