# systemd Services

<!-- BOOKSTACK-DOCUMENT-RELEASE:BEGIN -->
# systemd Services

| Field | Value |
| --- | --- |
| Distribution | BSS — OpenC5ISR |
| Product | OpenC5ISR |
| Release | 0.15.1 |
| Deployment | `openc5isr.bss.dev` |
| Source | `/srv/bss/releases/OpenC5ISR-v0.15.0-20app` |
| Evidence | Release and readable host service definitions |
| Source fingerprint | `93926e8c834f1ed79c9017a4096f70c76d73ce4f870f104fbd0cf54b2bed50ee` |
| Status | Generated baseline — human review required |

> **Verification boundary:** This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.

## Observed service units

| Unit | Description | User | Working directory | ExecStart | Restart | Evidence |
| --- | --- | --- | --- | --- | --- | --- |
| opencybersec-agent.service | OpenCyberSec Defensive Edge Sensor Agent | opencybersec | `—` | `/opt/opencybersec-agent/opencybersec_agent.py --config /etc/opencybersec-agent.json` | on-failure | `edge/opencybersec/systemd/opencybersec-agent.service` |
| openlvc-ais-bridge.service | OpenLVC AIS NMEA Bridge | rocketman | `/opt/opensof/edge/openlvc` | `/usr/bin/python3 /opt/opensof/edge/openlvc/ais_nmea_bridge.py --opensof ${OPENSOF_URL} --token [REDACTED] --bind 0.0.0.0 --port 10110` | on-failure | `edge/openlvc/systemd/openlvc-ais-bridge.service` |
| openlvc-dis-bridge.service | OpenLVC IEEE DIS UDP Bridge | rocketman | `/opt/opensof/edge/openlvc` | `/usr/bin/python3 /opt/opensof/edge/openlvc/dis_udp_bridge.py --opensof ${OPENSOF_URL} --token [REDACTED] --bind 0.0.0.0 --port 3000` | on-failure | `edge/openlvc/systemd/openlvc-dis-bridge.service` |
| openlvc-flightgear-bridge.service | OpenLVC FlightGear UDP Bridge | rocketman | `/opt/opensof/edge/openlvc` | `/usr/bin/python3 /opt/opensof/edge/openlvc/flightgear_bridge.py --opensof ${OPENSOF_URL} --token [REDACTED] --bind 0.0.0.0 --port 5505` | on-failure | `edge/openlvc/systemd/openlvc-flightgear-bridge.service` |
| openlvc-rti-gateway.service | OpenLVC OpenBus to HLA RTI Gateway | rocketman | `/opt/opensof/edge/openlvc` | `/usr/bin/python3 /opt/opensof/edge/openlvc/rti_openbus_gateway.py --opensof ${OPENSOF_URL} --token [REDACTED] --federation ${OPENLVC_FEDERATION} --federate ${OPENLVC_FEDERATE} --sidecar-command ${OPENLVC_RTI_SIDECAR_COMMAND}` | on-failure | `edge/openlvc/systemd/openlvc-rti-gateway.service` |
| openpnt-phc2sys@.service | OpenPNT linuxptp phc2sys instance %i | root | `—` | `/opt/openpnt/bin/openpnt-linuxptp run phc2sys --instance /etc/openpnt/linuxptp/instances/%i.json --bin-dir /opt/openpnt/linuxptp/bin` | on-failure | `edge/openpnt-linuxptp/systemd/openpnt-phc2sys@.service` |
| openpnt-ptp4l@.service | OpenPNT linuxptp ptp4l instance %i | root | `—` | `/opt/openpnt/bin/openpnt-linuxptp run ptp4l --instance /etc/openpnt/linuxptp/instances/%i.json --bin-dir /opt/openpnt/linuxptp/bin` | on-failure | `edge/openpnt-linuxptp/systemd/openpnt-ptp4l@.service` |
| openpnt-ts2phc@.service | OpenPNT linuxptp ts2phc instance %i | root | `—` | `/opt/openpnt/bin/openpnt-linuxptp run ts2phc --instance /etc/openpnt/linuxptp/instances/%i.json --bin-dir /opt/openpnt/linuxptp/bin` | on-failure | `edge/openpnt-linuxptp/systemd/openpnt-ts2phc@.service` |
| openrf-agent.service | OpenRF Radio Agent | __OPENRF_USER__ | `/opt/openrf-agent` | `/usr/local/bin/openrf-agent --config /etc/openrf/openrf-agent.json` | always | `openrf/agent/systemd/openrf-agent.service` |
| openc5isr-bss.service | OpenC5ISR - openc5isr.bss.dev | bss-ops | `/srv/bss/instances/openc5isr/current` | `/usr/local/bin/npm start` | on-failure | `/etc/systemd/system/openc5isr-bss.service` |

## Authoritative deployment checklist

- Copy unit files to /etc/systemd/system only from a reviewed release/deployment source.
- Run systemctl daemon-reload after unit changes, then enable/start the intended instance.
- Use a dedicated non-login service account with read-only release access and only required persistent-state permissions.
- Set WorkingDirectory and absolute ExecStart paths; do not depend on an interactive shell profile.
- Add health-aware dependencies and restart limits so a bad backend does not create a restart storm.

## Verification commands

```bash
systemctl cat <unit>.service
systemctl status <unit>.service --no-pager
systemctl show <unit>.service -p User -p Group -p WorkingDirectory -p ExecStart
journalctl -u <unit>.service -n 200 --no-pager
```
<!-- BOOKSTACK-DOCUMENT-RELEASE:END -->

---

## Maintainer Notes

<!-- BOOKSTACK-DOCUMENT-RELEASE:NOTES-BEGIN -->
Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.
<!-- BOOKSTACK-DOCUMENT-RELEASE:NOTES-END -->