[Unit]
Description=TallyNote expense records
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=tallynote
Group=tallynote
WorkingDirectory=/opt/tallynote/current
Environment=NODE_ENV=production
EnvironmentFile=-/etc/tallynote/tallynote.env
Environment=PATH=/opt/tallynote/current/runtime/bin:/usr/sbin:/usr/bin:/sbin:/bin
ExecStart=/opt/tallynote/current/bin/tallynote
Restart=on-failure
RestartSec=5s
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
InaccessiblePaths=/opt/tallynote/.update-work
ProtectHome=true
PrivateDevices=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectClock=true
LockPersonality=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
UMask=0077
ReadWritePaths=/var/lib/tallynote
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target