[Unit]
Description=nginx host control agent for nginx-webui (Docker)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
# Bind 0.0.0.0 so Docker containers reach it via host.docker.internal.
# The agent only acts on the paths below; restrict with a firewall if exposed.
ExecStart=/usr/local/bin/nginx-webui-host-agent.py --bind 0.0.0.0 --port 9401
Restart=on-failure
RestartSec=3
# Run as root. If unprivileged, instead install passwordless sudo rules, e.g.:
#   echo 'nginxadmin ALL=(ALL) NOPASSWD: /usr/sbin/nginx, /usr/bin/systemctl restart nginx' > /etc/sudoers.d/nginx-webui-agent

[Install]
WantedBy=multi-user.target