[Unit]
Description=Learnitive trusted API and runtime queue worker
After=network-online.target learnitive-redis.service learnitive-universal-runner.service
Wants=network-online.target
Requires=learnitive-redis.service learnitive-universal-runner.service
ConditionPathExists=@@LEARNITIVE_SITE_ROOT@@/public_html/server/index.mjs

[Service]
Type=simple
User=learnitive-os
Group=learnitive-os
WorkingDirectory=@@LEARNITIVE_SITE_ROOT@@
Environment=NODE_ENV=production
EnvironmentFile=/etc/learnitive/learnitive.env
ExecStartPre=/usr/bin/test -f @@LEARNITIVE_SITE_ROOT@@/public_html/dist/index.html
ExecStartPre=@@LEARNITIVE_SITE_ROOT@@/.learnitive-runtime/bin/node --version
ExecStartPre=@@LEARNITIVE_SITE_ROOT@@/.learnitive-runtime/bin/node @@LEARNITIVE_SITE_ROOT@@/public_html/server/saas-preflight.mjs
ExecStart=@@LEARNITIVE_SITE_ROOT@@/.learnitive-runtime/bin/node @@LEARNITIVE_SITE_ROOT@@/public_html/server/index.mjs
Restart=on-failure
RestartSec=3
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
UMask=0027
ProtectSystem=strict
ProtectHome=true
ReadOnlyPaths=/etc/learnitive @@LEARNITIVE_SITE_ROOT@@/public_html/server
ReadWritePaths=@@LEARNITIVE_SITE_ROOT@@/learnitive-data/audit @@LEARNITIVE_SITE_ROOT@@/learnitive-data/cache @@LEARNITIVE_SITE_ROOT@@/learnitive-data/tmp/queue @@LEARNITIVE_SITE_ROOT@@/learnitive-data/log @@LEARNITIVE_SITE_ROOT@@/learnitive-data/templates @@LEARNITIVE_SITE_ROOT@@/learnitive-media/blog @@LEARNITIVE_SITE_ROOT@@/learnitive-media/docs @@LEARNITIVE_SITE_ROOT@@/learnitive-media/learn @@LEARNITIVE_SITE_ROOT@@/learnitive-media/learn-private -@@LEARNITIVE_SITE_ROOT@@/public_html/dist/learnitive-media -@@LEARNITIVE_SITE_ROOT@@/public_html/dist/learnitive-templates
LockPersonality=true
RestrictSUIDSGID=true

[Install]
WantedBy=multi-user.target