[Unit]
Description=Waving Hands duel server
After=network.target

[Service]
Type=simple
User=waving-hands
WorkingDirectory=/opt/waving-hands/app/server
Environment=PORT=8788
# Caddy terminates TLS; the plaintext port must not face the internet.
Environment=HOST=127.0.0.1
Environment=WH_DATA_DIR=/var/lib/waving-hands/rooms
ExecStart=/opt/waving-hands/app/server/node_modules/.bin/tsx src/index.ts
Restart=always
RestartSec=3

# Sandbox: the process reads /opt/waving-hands and writes only its data dir.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/waving-hands
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
# A runaway process gets killed and restarted before it can take the box down.
MemoryMax=300M
LimitNOFILE=4096

[Install]
WantedBy=multi-user.target