[Unit]
Description=pub-repo — git-remote met publiek/prive-toggle (:3300)
After=network.target

[Service]
Type=simple
User=pubrepo
Group=pubrepo
WorkingDirectory=/opt/pub-repo
EnvironmentFile=/opt/pub-repo/.env
ExecStart=/usr/bin/node src/index.ts
Restart=always
RestartSec=3

# Alleen de repository-map mag beschreven worden.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=strict
ReadWritePaths=/var/lib/pub-repo
ProtectKernelTunables=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes

StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target