From 351e62f736ff59546617e68fe80eb7e3b9ce55b6 Mon Sep 17 00:00:00 2001
From: Dax Davis <98216+rubicon@users.noreply.github.com>
Date: Sun, 9 Aug 2026 16:22:27 -0500
Subject: [PATCH] fix(deploy): survive the MCP idle watchdog exit in the
 systemd unit

The idle watchdog terminates the process with os._exit(0). systemd's
Restart=on-failure does not restart a unit that exits 0, so a server
installed from this template stops for good after the idle timeout
rather than restarting.

Switch the unit to Restart=always and disable the watchdog in the
server env template, since a dedicated always-on server is not the
per-session case the watchdog was added for.
---
 deploy/mempalace-server.service | 5 ++++-
 deploy/server.env.example       | 7 +++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/deploy/mempalace-server.service b/deploy/mempalace-server.service
index f5ff5b8..2e23289 100644
--- a/deploy/mempalace-server.service
+++ b/deploy/mempalace-server.service
@@ -24,7 +24,10 @@ User=mempalace
 Group=mempalace
 EnvironmentFile=/etc/mempalace/server.env
 ExecStart=mempalace serve --host 0.0.0.0 --port 8765
-Restart=on-failure
+# The idle watchdog exits with status 0, which on-failure reads as an
+# intentional stop, so the server would stay down. server.env disables the
+# watchdog; Restart=always covers a deployment that has not set it.
+Restart=always
 RestartSec=2
 
 # --- Hardening ---------------------------------------------------------------
diff --git a/deploy/server.env.example b/deploy/server.env.example
index d6d3093..b2c6aea 100644
--- a/deploy/server.env.example
+++ b/deploy/server.env.example
@@ -23,6 +23,13 @@ MEMPALACE_EMBEDDING_DEVICE=auto
 # MEMPALACE_MCP_TLS_CERT=/etc/mempalace/tls/cert.pem
 # MEMPALACE_MCP_TLS_KEY=/etc/mempalace/tls/key.pem
 
+# --- Server lifecycle -----------------------------------------------------------
+# The MCP server exits by itself after this many idle hours (default 8) to free
+# the ChromaDB/HNSW file handles that per-session stdio servers leave behind.
+# A dedicated always-on server does not need that, so 0 disables it. Note that
+# /healthz traffic does not count as activity; only MCP requests reset the timer.
+MEMPALACE_MCP_IDLE_HOURS=0
+
 # --- Palace location (systemd / bare-metal) -------------------------------------
 # In Docker the palace lives on the mempalace-data volume by default.
 # MEMPALACE_PALACE_PATH=/var/lib/mempalace/palace