[Unit]
Description=volundr (bike service-due + MOT/insurance tracker)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=bike
Group=bike
WorkingDirectory=/opt/bike_admin
# Leading `-` = optional: the app still boots (and prompts for a password)
# if the .env has not been created yet.
EnvironmentFile=-/opt/bike_admin/.env
ExecStart=/opt/bike_admin/.venv/bin/uvicorn app.main:app \
  --host 0.0.0.0 --port 8000 \
  --forwarded-allow-ips 192.168.0.0/16 --proxy-headers
Restart=on-failure
RestartSec=2
# Hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
# App data lives next to the checkout at /opt/bike_admin/data (created by the
# app on startup). systemd requires the ReadWritePaths target to exist before
# it starts the service, so pre-create it with:
#   sudo install -d -o bike -g bike /opt/bike_admin/data
ReadWritePaths=/opt/bike_admin/data

[Install]
WantedBy=multi-user.target