[Unit]
Description=Wiz-War game server
After=network.target

[Service]
Type=simple
User=wizwar
WorkingDirectory=/opt/wizwar/packages/server
Environment=PORT=8787
# Caddy terminates TLS; the plaintext port must not face the internet.
Environment=HOST=127.0.0.1
Environment=WIZWAR_DATA_DIR=/var/lib/wizwar/rooms
Environment=WIZWAR_STATIC_DIR=/opt/wizwar/packages/web/dist
ExecStart=/opt/wizwar/node_modules/.bin/tsx src/index.ts
Restart=always
RestartSec=3

# Sandbox: the process reads /opt/wizwar and writes only its data dir.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/wizwar
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
# A runaway process gets killed and restarted before it can take the box down.
MemoryMax=700M
LimitNOFILE=4096

[Install]
WantedBy=multi-user.target