[Unit]
Description=Filehost private file hosting service
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=filehost
Group=filehost
WorkingDirectory=/opt/filehost
EnvironmentFile=/opt/filehost/.env
ExecStart=/usr/local/bin/bun run src/server.ts
Restart=on-failure
RestartSec=3
TimeoutStopSec=30

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
ReadWritePaths=/opt/filehost/storage

[Install]
WantedBy=multi-user.target