[Unit]
Description=Hnefatafl game server
After=network.target

[Service]
Type=simple
User=hnefatafl
WorkingDirectory=/opt/hnefatafl/app/server
Environment=PORT=8789
Environment=KEEPER=Kestrel
Environment=KEEPER_TZ=America/New_York
# Caddy terminates TLS; the plaintext port must not face the internet.
Environment=HOST=127.0.0.1
Environment=DATA_DIR=/var/lib/hnefatafl/rooms
# Empty means no error reporting.
Environment=SENTRY_DSN=https://2e3589c41ea45a58049740d3af64face@o4509525984149504.ingest.us.sentry.io/4512136791130112
ExecStart=/opt/hnefatafl/app/server/node_modules/.bin/tsx src/index.ts
Restart=always
RestartSec=3

# Sandbox: the process reads /opt/hnefatafl and writes only its data dir.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/hnefatafl
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
# A runaway process gets killed and restarted before it can take the box down.
MemoryMax=300M
LimitNOFILE=4096

[Install]
WantedBy=multi-user.target