From cd625f9103a62bde27daca6718ad0b1e652cb641 Mon Sep 17 00:00:00 2001
From: tecnotel <cyber@tecnotelsrl.com>
Date: Thu, 2 Jul 2026 16:06:18 +0200
Subject: [PATCH] Update setup_server.py

---
 setup_server.py | 49 +++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 47 insertions(+), 2 deletions(-)

diff --git a/setup_server.py b/setup_server.py
index 594c9e3..0a9d6d7 100644
--- a/setup_server.py
+++ b/setup_server.py
@@ -524,8 +524,12 @@ extendedKeyUsage     = serverAuth
         log("── Creazione e avvio servizi ──")
         _write_services()
         run("systemctl daemon-reload")
-        for svc in ["argos-backend", "argos-sync", "argos-ops", "argos-analytics",
-                    "argos-updater"]:
+        svc_list = ["argos-backend", "argos-sync", "argos-ops", "argos-analytics",
+                    "argos-updater"]
+        # Watchguard: solo se la unit è stata generata (demone presente nel repo)
+        if Path("/etc/systemd/system/argos-watchguard.service").exists():
+            svc_list.append("argos-watchguard")
+        for svc in svc_list:
             run(f"systemctl enable --now {svc}")
             log(f"{svc} avviato")
 
@@ -748,6 +752,47 @@ WantedBy=multi-user.target
         with open(f"/etc/systemd/system/argos-{svc}.service", "w") as f:
             f.write(unit)
 
+    # ── argos-watchguard: demone di supervisione autonomo ────────────────────
+    # NON è Gunicorn (loop Python puro), quindi unit dedicata fuori dal loop.
+    # Non ha After=argos-analytics: deve girare anche se gli altri sono giù.
+    wg_src = f"{services_dir}/argos_watchguard.py"
+    if Path(wg_src).exists():
+        # python3-systemd opzionale (solo per WatchdogSec). Se assente, ok senza.
+        wg_watchdog = ""
+        try:
+            subprocess.run([f"{venv_bin}/python3", "-c", "import systemd.daemon"],
+                           check=True, capture_output=True)
+            wg_watchdog = "WatchdogSec=300\n"
+        except Exception:
+            pass
+        wg_unit = f"""[Unit]
+Description=ARGOS Watchguard — supervisione autonoma servizi/cache/log
+After=network.target
+
+[Service]
+Type=simple
+User={APP_USER}
+Group={APP_USER}
+WorkingDirectory={backend_dir}
+Environment=PYTHONPATH={backend_dir}:{services_dir}
+Environment=ARGOS_DATA={DATA_DIR}
+Environment=ARGOS_LOGS={LOGS_DIR}
+Environment=WATCHGUARD_INTERVAL=120
+Environment=WATCHGUARD_STALE_FACTOR=2.0
+Environment=WATCHGUARD_LOG_WINDOW_MIN=60
+ExecStart={venv_bin}/python {wg_src}
+Restart=always
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=argos-watchguard
+{wg_watchdog}
+[Install]
+WantedBy=multi-user.target
+"""
+        with open("/etc/systemd/system/argos-watchguard.service", "w") as f:
+            f.write(wg_unit)
+
 
 class SetupHandler(BaseHTTPRequestHandler):
     def log_message(self, *args): pass