fix: install system service as root in cloudformation

Author: pRizz

docs/deploy/aws.md

@@ -118,6 +118,13 @@ You can check the installed version on the instance:
 opencode-cloud --version
 ```
 
+CloudFormation installs a **system-level** systemd unit that runs as `ubuntu`.
+Check service status with:
+
+```bash
+sudo systemctl status opencode-cloud
+```
+
 ## Provisioning Script Architecture
 
 The CloudFormation and cloud-init templates now bootstrap provisioning from

packages/core/src/platform/systemd.rs

@@ -68,6 +68,17 @@ impl SystemdManager {
         // This gives enough window for the allowed burst of restarts
         let start_limit_interval = config.restart_delay * config.restart_retries * 2;
 
+        let service_user_line = if !self.user_mode {
+            std::env::var("OPENCODE_SERVICE_USER")
+                .ok()
+                .map(|value| value.trim().to_string())
+                .filter(|value| !value.is_empty())
+                .map(|value| format!("User={value}\n"))
+                .unwrap_or_default()
+        } else {
+            String::new()
+        };
+
         format!(
             r#"[Unit]
 Description=opencode-cloud container service
@@ -77,7 +88,7 @@ Requires=docker.service
 
 [Service]
 Type=simple
-ExecStart={exec_start}
+{service_user_line}ExecStart={exec_start}
 ExecStop={exec_stop}
 Restart=on-failure
 RestartSec={restart_delay}s
@@ -92,6 +103,7 @@ WantedBy=default.target
             restart_delay = config.restart_delay,
             restart_retries = config.restart_retries,
             start_limit_interval = start_limit_interval,
+            service_user_line = service_user_line,
         )
     }
 
@@ -361,6 +373,25 @@ mod tests {
         assert!(unit.contains("StartLimitIntervalSec=100")); // 10 * 5 * 2
     }
 
+    #[test]
+    fn test_generate_unit_file_system_user() {
+        std::env::set_var("OPENCODE_SERVICE_USER", "ubuntu");
+
+        let manager = SystemdManager::new("system");
+        let config = ServiceConfig {
+            executable_path: PathBuf::from("/usr/bin/occ"),
+            restart_retries: 3,
+            restart_delay: 5,
+            boot_mode: "system".to_string(),
+        };
+
+        let unit = manager.generate_unit_file(&config);
+
+        assert!(unit.contains("User=ubuntu"));
+
+        std::env::remove_var("OPENCODE_SERVICE_USER");
+    }
+
     #[test]
     fn test_is_installed_returns_false_for_nonexistent() {
         let manager = SystemdManager::new("user");

scripts/provisioning/opencode-cloud-setup-cloudformation.sh

@@ -144,7 +144,7 @@ opencode_setup_log "opencode-cloud setup: set boot_mode=system for cloudformatio
 opencode_setup_run_as_user "opencode-cloud config set boot_mode system"
 
 opencode_setup_log "opencode-cloud setup: install service (system-level)"
-opencode_setup_run_as_user "opencode-cloud install --force"
+opencode_setup_run_as_root_with_user_env "opencode-cloud install --force"
 opencode_setup_log "opencode-cloud setup: service install complete (system-level)"
 
 opencode_setup_log "opencode-cloud setup: restart container after service install"

scripts/provisioning/opencode-cloud-setup.sh

@@ -141,6 +141,27 @@ opencode_setup_run_as_user() {
   fi
 }
 
+opencode_setup_run_as_root_with_user_env() {
+  local cmd="$*"
+  local target_home="${OPENCODE_SETUP_HOME:-/root}"
+  local service_user="${OPENCODE_SETUP_USER:-}"
+  local target_path="$target_home/.cargo/bin:$PATH"
+  local -a env_args=(
+    "HOME=$target_home"
+    "XDG_CONFIG_HOME=$target_home/.config"
+    "XDG_DATA_HOME=$target_home/.local/share"
+    "XDG_STATE_HOME=$target_home/.local/state"
+    "XDG_CACHE_HOME=$target_home/.cache"
+    "PATH=$target_path"
+  )
+
+  if [ -n "$service_user" ]; then
+    env_args=("OPENCODE_SERVICE_USER=$service_user" "${env_args[@]}")
+  fi
+
+  env "${env_args[@]}" bash -lc "$cmd"
+}
+
 opencode_setup_ensure_rust_toolchain() {
   if ! opencode_setup_run_as_user "command -v cargo >/dev/null 2>&1"; then
     opencode_setup_log "opencode-cloud setup: install rust toolchain"