[Unit]
Description=Timmy private staging service
Documentation=file:/opt/timmy-staging/current/docs/STAGING-RUNBOOK.md
After=network.target

[Service]
Type=simple
User=timmy-staging
Group=timmy-staging
UMask=0077
WorkingDirectory=/opt/timmy-staging/current
Environment=NODE_ENV=production
Environment=HOST=127.0.0.1
Environment=PORT=4174
Environment=TIMMY_BASE_PATH=/timmy-staging
Environment=TIMMY_AGENT_ENABLED=false
Environment=TIMMY_VISION_ENABLED=false
EnvironmentFile=/etc/timmy-staging.env
ExecStart=/usr/bin/node server.mjs
Restart=on-failure
RestartSec=5s
TimeoutStartSec=30s
TimeoutStopSec=15s
KillSignal=SIGTERM

# Filesystem and privilege boundary. Only state is writable.
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/timmy-staging
StateDirectory=timmy-staging
StateDirectoryMode=0700
RestrictSUIDSGID=true
LockPersonality=true
RestrictNamespaces=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectClock=true
ProtectHostname=true
CapabilityBoundingSet=
AmbientCapabilities=

# Process, syscall, network, and resource boundary.
RestrictRealtime=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
ProtectProc=invisible
ProcSubset=pid
TasksMax=64
MemoryMax=512M
CPUQuota=100%
LimitNOFILE=1024

[Install]
WantedBy=multi-user.target