[Unit]
Description=__NAME__ game server
After=network.target

[Service]
Type=simple
User=__SLUG__
WorkingDirectory=/opt/__SLUG__/app/server
Environment=PORT=__PORT__
Environment=KEEPER=Kestrel
Environment=KEEPER_TZ=America/New_York
# Caddy terminates TLS; the plaintext port must not face the internet.
Environment=HOST=127.0.0.1
Environment=DATA_DIR=/var/lib/__SLUG__/rooms
# Empty means no error reporting.
Environment=SENTRY_DSN=__SENTRY_DSN__
ExecStart=/opt/__SLUG__/app/server/node_modules/.bin/tsx src/index.ts
Restart=always
RestartSec=3

# Sandbox: the process reads /opt/__SLUG__ and writes only its data dir.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/__SLUG__
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
# A runaway process gets killed and restarted before it can take the box down.
MemoryMax=300M
LimitNOFILE=4096

[Install]
WantedBy=multi-user.target