[Unit]
Description=TallyNote expense records
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=tallynote
Group=tallynote
WorkingDirectory=/opt/tallynote/current
Environment=NODE_ENV=production
EnvironmentFile=-/etc/tallynote/tallynote.env
Environment=TALLYNOTE_CONFIG_DIR=/etc/tallynote
Environment=PATH=/usr/local/bin:/usr/bin:/usr/sbin:/sbin:/bin
ExecStart=/opt/tallynote/current/bin/tallynote
Restart=on-failure
RestartSec=5s
# Do not let a wedged Node process hold an update stop forever.
TimeoutStopSec=30s
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
InaccessiblePaths=/opt/tallynote/.update-work
ProtectHome=true
PrivateDevices=true
# Fastify logs the addresses of wildcard listeners. Node's libuv uses the
# Linux netlink family while enumerating interfaces for that log message.
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectClock=true
LockPersonality=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
UMask=0077
ReadWritePaths=/var/lib/tallynote
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target