systemd: fix unit file warnings + start_webadmin PATH + migrate bug

Three issues caught while migrating FireVPS:

* systemd[1]: "Unknown key 'StartLimitIntervalSec' in section [Service]"
  — those directives belong under [Unit], not [Service]. systemd
  silently ignored them and applied defaults. Move to [Unit] in both
  units.

* supportproxy-webadmin exited 127 ("command not found") because
  start_webadmin.sh's `exec gunicorn ...` runs under systemd's
  default PATH (no ~/.local/bin), and FireVPS uses a pip-user-install
  for gunicorn rather than a venv. The existing `source venv/bin/
  activate` line gracefully no-ops when there's no venv, but PATH
  was left without ~/.local/bin. Prepend it explicitly.

* migrate_to_systemd.sh had `$SUDO -u "$SP_USER" tee ...` which
  expands to `-u fire tee ...` (i.e. tries to run `-u` as a command)
  when SUDO is empty because we're already root. Write the file with
  $SUDO tee and chown it to the daemon user afterwards.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: tridge

scripts/migrate_to_systemd.sh

@@ -193,7 +193,7 @@ WUI=$DATA/webui.json
 if [ -f "$WUI" ]; then
     $SUDO cp -p "$WUI" "$WUI.bak.$(date +%Y%m%d-%H%M%S)"
 fi
-$SUDO -u "$SP_USER" tee "$WUI" >/dev/null <<JSON
+$SUDO tee "$WUI" >/dev/null <<JSON
 {
     "title": "SupportProxy ($SP_DOMAIN)",
     "mode": "standalone",
@@ -202,6 +202,11 @@ $SUDO -u "$SP_USER" tee "$WUI" >/dev/null <<JSON
     "behind_proxy": true
 }
 JSON
+# Make sure the file is owned by the daemon user — `$SUDO tee` writes
+# as root, but the running supportproxy daemon reads as $SP_USER and
+# never writes here, so 0644 + chown is fine.
+$SUDO chown "$SP_USER:$SP_USER" "$WUI"
+$SUDO chmod 644 "$WUI"
 
 # ----- 8. systemd units ----------------------------------------------
 echo

start_webadmin.sh

@@ -36,6 +36,11 @@ export WEBADMIN_SECRET_KEY="$(cat .webadmin_secret)"
 export WEBADMIN_KEYDB_PATH="$(pwd)/keys.tdb"
 export PYTHONPATH="$HOME/SupportProxy"
 
+# Prepend ~/.local/bin for pip user-install gunicorn (the README's
+# alternative to a venv). systemd's default PATH doesn't include it,
+# so without this exec gunicorn would exit 127.
+export PATH="$HOME/.local/bin:$PATH"
+
 gunicorn_args=( -w 1 -k gthread --threads 4
                 --timeout 60 --graceful-timeout 30
                 -b "$webui_host:$webui_port" )

systemd/supportproxy-webadmin.service

@@ -3,6 +3,8 @@ Description=SupportProxy web admin UI (gunicorn)
 Documentation=https://github.com/ArduPilot/SupportProxy
 After=network-online.target supportproxy.service
 Wants=network-online.target
+StartLimitIntervalSec=60
+StartLimitBurst=5
 
 [Service]
 Type=simple
@@ -19,8 +21,6 @@ ExecStart=/home/support/SupportProxy/start_webadmin.sh
 # someone running `pkill -f webadmin.wsgi:application` by hand.
 Restart=always
 RestartSec=5s
-StartLimitIntervalSec=60
-StartLimitBurst=5
 StandardOutput=append:/home/support/proxy/webui.log
 StandardError=inherit
 

systemd/supportproxy.service

@@ -3,6 +3,13 @@ Description=SupportProxy MAVLink proxy daemon
 Documentation=https://github.com/ArduPilot/SupportProxy
 After=network-online.target
 Wants=network-online.target
+# Bail out of the restart loop if the binary is genuinely broken:
+# 5 restarts within 60 s puts the unit into failed state for an
+# operator to investigate (journalctl -u supportproxy will show
+# why). Resume with `systemctl reset-failed supportproxy &&
+# systemctl start supportproxy` once fixed.
+StartLimitIntervalSec=60
+StartLimitBurst=5
 
 [Service]
 Type=simple
@@ -16,13 +23,6 @@ ExecStart=/home/support/SupportProxy/supportproxy
 # an accidental external pkill.
 Restart=always
 RestartSec=5s
-# Bail out of the restart loop if the binary is genuinely broken:
-# 5 restarts within 60 s puts the unit into failed state for an
-# operator to investigate (journalctl -u supportproxy will show
-# why). Resume with `systemctl reset-failed supportproxy &&
-# systemctl start supportproxy` once fixed.
-StartLimitIntervalSec=60
-StartLimitBurst=5
 # The daemon's printf output is the activity log; mirror it to the
 # legacy proxy.log path so existing tail-and-grep habits still work.
 # Append-mode is safe across restarts; systemd opens the file each