added systemd service and installation file

agent/README.md

@@ -20,6 +20,57 @@ To rotate/re-enroll an existing agent identity, add `-force-enroll` with a fresh
 
 You can also pass `KEYWARDEN_SERVER_URL` and `KEYWARDEN_ENROLL_TOKEN` as environment variables.
 
+## systemd service (portable)
+
+The repo includes a reusable unit file and installer:
+
+- Unit: `systemd/keywarden-agent.service`
+- Env template: `systemd/keywarden-agent.env.example`
+- Installer: `scripts/install-systemd.sh`
+
+### Quick install
+
+From this `agent/` directory:
+
+```bash
+go build -o keywarden-agent ./cmd/keywarden-agent
+sudo ./scripts/install-systemd.sh
+sudoedit /etc/default/keywarden-agent
+sudo systemctl enable --now keywarden-agent
+```
+
+### Manual install
+
+```bash
+sudo install -D -m 0755 ./keywarden-agent /usr/local/bin/keywarden-agent
+sudo install -D -m 0644 ./systemd/keywarden-agent.service /etc/systemd/system/keywarden-agent.service
+sudo install -D -m 0640 ./systemd/keywarden-agent.env.example /etc/default/keywarden-agent
+sudo mkdir -p /etc/keywarden
+sudo bash -c 'cat > /etc/keywarden/agent.json <<EOF
+{
+  "server_url": "https://keywarden.example.com/api/v1"
+}
+EOF'
+sudo chmod 0600 /etc/keywarden/agent.json
+sudo systemctl daemon-reload
+sudo systemctl enable --now keywarden-agent
+```
+
+### First boot behavior
+
+- If `/etc/keywarden/agent.json` does not exist, set `KEYWARDEN_SERVER_URL` in `/etc/default/keywarden-agent`.
+- For first enrollment, set `KEYWARDEN_ENROLL_TOKEN` in `/etc/default/keywarden-agent`.
+- After successful enrollment, `server_id` and `agent_api_token` are written to `agent.json`.
+- You can remove `KEYWARDEN_ENROLL_TOKEN` from `/etc/default/keywarden-agent` after enrollment.
+
+### Service operations
+
+```bash
+sudo systemctl status keywarden-agent
+sudo journalctl -u keywarden-agent -f
+sudo systemctl restart keywarden-agent
+```
+
 ## Config
 
 On first boot, the agent will create a config file if it does not exist. Only `server_url` is required for bootstrapping.