[Unit]
Description=TeXise trusted API (accounts, licensing, CMS, scholarly and AI fallback)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=texise
Group=texise
WorkingDirectory=/var/www/texise.com/public_html/texise-data/runtime/current/server
EnvironmentFile=/etc/texise/texise.env
EnvironmentFile=/var/www/texise.com/public_html/texise-data/runtime/current/release.env
ExecStart=/usr/bin/node /var/www/texise.com/public_html/texise-data/runtime/current/server/index.mjs
Restart=on-failure
RestartSec=3
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
UMask=0027
ProtectSystem=strict
ProtectHome=true
ReadOnlyPaths=/etc/texise /var/www/texise.com/public_html/texise-data/runtime/current
ReadWritePaths=/var/www/texise.com/public_html/texise-data/audit /var/www/texise.com/public_html/texise-data/cache /var/www/texise.com/public_html/texise-data/tmp /var/www/texise.com/public_html/texise-data/log /var/www/texise.com/texise-media/blog /var/www/texise.com/texise-media/docs /var/www/texise.com/templates /var/www/texise.com/public_html/dist/texise-templates /var/www/texise.com/public_html/dist/texise-media
LockPersonality=true
RestrictSUIDSGID=true

[Install]
WantedBy=multi-user.target