# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1

[Unit]
Description=Progmaweb Next.js frontend
After=network-online.target progmaweb-api.service
Wants=network-online.target
Requires=progmaweb-api.service

[Service]
Type=exec
User=progmaweb
Group=progmaweb
WorkingDirectory=/srv/progmaweb/current/web/apps/web
ExecStart=/opt/progmaweb/node/bin/node /srv/progmaweb/current/web/apps/web/server.js
Environment=NODE_ENV=production
Environment=HOSTNAME=127.0.0.1
Environment=PORT=3010
Environment=PROGMAWEB_API_ORIGIN=http://127.0.0.1:5085
Restart=on-failure
RestartSec=5s
TimeoutStopSec=30s
# Node reports SIGTERM as status 143 during an intentional systemd stop. Treat
# that graceful shutdown as success so deployments do not leave a false failed
# result in the service history.
SuccessExitStatus=143

# Standalone Next.js only reads immutable release files and opens its loopback listener.
UMask=0077
AmbientCapabilities=
CapabilityBoundingSet=
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectClock=true
ProtectHome=true
ProtectHostname=true
ProtectSystem=strict
ProtectKernelLogs=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RemoveIPC=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target