[Unit]
Description=Wellformed app-server (:4000)
After=network.target

[Service]
Type=simple
User=wellformed
Group=wellformed
WorkingDirectory=/opt/wellformed
EnvironmentFile=/opt/wellformed/.env
ExecStart=/usr/bin/node packages/server/dist/index.js
Restart=always
RestartSec=3

# Sandboxing. The data directory is the only thing the service may write to:
# every workspace is a SQLite file under it, so it must stay read-write while
# the rest of the filesystem does not.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=full
ReadWritePaths=/opt/wellformed/data
ProtectKernelTunables=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes

StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target