[Unit]
Description=OpenDance Studio Web 管理服务端（NestJS）
Documentation=https://<Gitea 地址>/<owner>/opendance-web
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=__SERVICE_USER__
Group=__SERVICE_USER__
WorkingDirectory=__APP_DIR__/web-server
EnvironmentFile=__APP_DIR__/deploy/.env
ExecStart=__NODE_BIN__ dist/main.js
Restart=always
RestartSec=3
StandardOutput=journal
StandardError=journal
SyslogIdentifier=opendance-api

# ---- 安全加固（进程只应写自己的存储目录）----
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
LockPersonality=true
ReadWritePaths=__STORAGE_PARENT__

[Install]
WantedBy=multi-user.target