[Unit]
Description=Clank Together coordinator: website, API and git
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=togetherdecomp
Group=togetherdecomp
WorkingDirectory=/var/lib/togetherdecomp
ExecStart=/opt/node/bin/node --disable-warning=ExperimentalWarning /opt/togetherdecomp/src/server/cli.js start web --data /var/lib/togetherdecomp
Restart=on-failure
RestartSec=5
TimeoutStopSec=15
Environment=NODE_ENV=production
Environment=TD_WEB_DIR=/opt/togetherdecomp/src/server/web

# Hardening. The process needs: its data dir and git. Compiling happens in togetherdecomp-worker.
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/togetherdecomp
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectClock=true
ProtectHostname=true
RestrictSUIDSGID=true
RestrictRealtime=true
RestrictNamespaces=true
LockPersonality=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
CapabilityBoundingSet=
SystemCallArchitectures=native
# 0022 so the sandboxed (uid-remapped) compiler can read job files; the data
# dir itself is 0700, which keeps everything private to this user.
UMask=0022

[Install]
WantedBy=multi-user.target