[Unit]
Description=PHP Cloudlinux SSA Agent Socket
PartOf=ssa-agent.service

[Socket]
ListenStream=/opt/alt/clos_ssa/run/ssa.sock
# SocketMode=0666 is intentional: the socket must be writable by PHP
# processes running under any web server (Apache, LiteSpeed, Nginx)
# across all supported panels (cPanel, Plesk, DirectAdmin).
# Restricting via SocketGroup is not feasible because the group owning
# PHP workers differs per panel and web server combination.
# Input validation in agent.py _validate_input() limits accepted payloads
# to the exact format produced by the C extension (7 fields with strict
# types). Sender authenticity is enforced separately by
# SimpleAgent._authorize_sender() using the kernel-trusted SO_PEERCRED
# UID: a tenant account may only submit metrics for a domain it owns, so a
# world-writable socket does not allow cross-tenant metric spoofing.
SocketMode=0666
Backlog=2048

[Install]
WantedBy=sockets.target