[Unit]
Description=Wyrm game server
After=network.target

[Service]
Type=simple
User=wyrm
WorkingDirectory=/opt/wyrm/app/server
Environment=PORT=8791
Environment=KEEPER=Kestrel
Environment=KEEPER_TZ=America/New_York
# Caddy terminates TLS; the plaintext port must not face the internet.
Environment=HOST=127.0.0.1
Environment=DATA_DIR=/var/lib/wyrm/rooms
# Empty means no error reporting.
Environment=SENTRY_DSN=https://a5e245adb21413c0b22dfa6b7a10f08a@o4509525984149504.ingest.us.sentry.io/4512325594578944
ExecStart=/opt/wyrm/app/server/node_modules/.bin/tsx src/index.ts
Restart=always
RestartSec=3

# Sandbox: the process reads /opt/wyrm and writes only its data dir.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/wyrm
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
# A runaway process gets killed and restarted before it can take the box down.
MemoryMax=300M
LimitNOFILE=4096

[Install]
WantedBy=multi-user.target