From 69d8af8693e5111542219ab51eac03716c909d29 Mon Sep 17 00:00:00 2001
From: RuneBot14 <runebot14@example.com>
Date: Sat, 14 Mar 2026 23:57:30 +0100
Subject: [PATCH] fix: service template crashes on empty AURORA_EXTRA_ARGS

Two bugs in the systemd service template:

1. Empty AURORA_EXTRA_ARGS causes Aurora to crash on startup.
   systemd passes ${AURORA_EXTRA_ARGS} as a literal empty string
   argument, which cobra interprets as an unknown subcommand:
     error: unknown command "" for "aurora"
   Fix: wrap ExecStart in bash -c with unquoted $AURORA_EXTRA_ARGS
   so empty vars expand to nothing (standard shell word splitting).

2. Wrong default rules path: the unit file had
   /opt/aurora-linux/sigma-rules/rules/linux but the install script
   places rules at /opt/aurora-linux/sigma-rules/linux.
   The EnvironmentFile override masked this, but fresh installs
   without a custom env file would fail.

Tested: Aurora starts cleanly with empty AURORA_EXTRA_ARGS and
loads 194 Sigma rules from the correct path.
---
 deploy/aurora.service | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/deploy/aurora.service b/deploy/aurora.service
index 323623c..75a6d5d 100644
--- a/deploy/aurora.service
+++ b/deploy/aurora.service
@@ -4,16 +4,16 @@ After=network.target
 
 [Service]
 Type=simple
-Environment=AURORA_RULES_DIR=/opt/aurora-linux/sigma-rules/rules/linux
+Environment=AURORA_RULES_DIR=/opt/aurora-linux/sigma-rules/linux
 Environment=AURORA_LOG_FILE=/var/log/aurora-linux/aurora.log
 Environment=AURORA_OUTPUT_FLAG=--json
 Environment=AURORA_EXTRA_ARGS=
 EnvironmentFile=-/opt/aurora-linux/config/aurora.env
-ExecStart=/opt/aurora-linux/aurora \
-    --rules ${AURORA_RULES_DIR} \
-    --logfile ${AURORA_LOG_FILE} \
-    ${AURORA_OUTPUT_FLAG} \
-    ${AURORA_EXTRA_ARGS}
+ExecStart=/bin/bash -c 'exec /opt/aurora-linux/aurora \
+    --rules "$AURORA_RULES_DIR" \
+    --logfile "$AURORA_LOG_FILE" \
+    $AURORA_OUTPUT_FLAG \
+    $AURORA_EXTRA_ARGS'
 Restart=on-failure
 RestartSec=5