# /etc/systemd/system/bookshop.service — a Littoral application as a service.
# Install the executable `make build` writes as /opt/bookshop/bookshop, then:
#   systemctl daemon-reload && systemctl enable --now bookshop
[Unit]
Description=Bookshop (Littoral)
After=network-online.target postgresql.service
Wants=network-online.target

[Service]
Type=simple
User=bookshop
Group=bookshop
WorkingDirectory=/opt/bookshop
ExecStart=/opt/bookshop/bookshop
Environment=PORT=8080
Environment=ADDRESS=127.0.0.1
Environment=PUBLIC_URL=https://bookshop.example.org
Environment=TRUST_PROXY=1
Environment=DATA_DIR=/opt/bookshop/data
EnvironmentFile=-/etc/bookshop.env
Restart=on-failure
RestartSec=2
# SBCL ignores SIGTERM while Hunchentoot threads run; give it a moment, then kill.
TimeoutStopSec=5
KillSignal=SIGTERM
SendSIGKILL=yes
# Hardening: a web application needs little of the system.
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/opt/bookshop/data
PrivateTmp=yes

[Install]
WantedBy=multi-user.target