[Unit]
Description=Learnitive private Docker console gateway
After=network-online.target docker.service learnitive-console-egress.service learnitive-egress-proxy.service
Wants=network-online.target
Requires=docker.service learnitive-console-egress.service learnitive-egress-proxy.service
ConditionPathExists=@@LEARNITIVE_SITE_ROOT@@/public_html/learnitive-services/console-gateway/server.js

[Service]
Type=simple
User=learnitive-os-console
Group=learnitive-os-console
SupplementaryGroups=docker
WorkingDirectory=@@LEARNITIVE_SITE_ROOT@@
Environment=NODE_ENV=production
Environment=PORT=9887
Environment=BIND_HOST=127.0.0.1
Environment=LEARNITIVE_DEPLOYMENT=@@LEARNITIVE_DEPLOYMENT@@
EnvironmentFile=/etc/learnitive/console-gateway.env
ExecStartPre=@@LEARNITIVE_SITE_ROOT@@/.learnitive-runtime/bin/node --version
ExecStart=@@LEARNITIVE_SITE_ROOT@@/.learnitive-runtime/bin/node @@LEARNITIVE_SITE_ROOT@@/public_html/learnitive-services/console-gateway/server.js
Restart=always
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
UMask=0027
ReadOnlyPaths=@@LEARNITIVE_SITE_ROOT@@/public_html/learnitive-services/console-gateway
ReadWritePaths=@@LEARNITIVE_SITE_ROOT@@/learnitive-data/tmp/console
InaccessiblePaths=/etc/learnitive
LockPersonality=true
RestrictSUIDSGID=true

[Install]
WantedBy=multi-user.target