[Unit]
Description=TeXise private Docker-isolated LaTeX Cloud Compile service
After=network-online.target docker.service
Wants=network-online.target
Requires=docker.service

[Service]
Type=simple
WorkingDirectory=/var/www/texise.com/public_html/texise-services/cloud-compile
Environment=NODE_ENV=production
EnvironmentFile=/etc/texise/cloud-compile.env
ExecStart=/usr/bin/node /var/www/texise.com/public_html/texise-services/cloud-compile/server.js
Restart=always
RestartSec=5
User=texise-compile
Group=texise-compile
SupplementaryGroups=docker
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
UMask=0027
ReadOnlyPaths=/var/www/texise.com/public_html/texise-services/cloud-compile
ReadWritePaths=/var/www/texise.com/public_html/texise-data/tmp/cloud-compile
InaccessiblePaths=/etc/texise
LockPersonality=true
RestrictSUIDSGID=true

[Install]
WantedBy=multi-user.target