# systemd unit for the PPS Quarantine Manager.
#
# Install (as root):
#   see deploy/README.md for the full walk-through. In short:
#   1. put the app in /opt/ppsq, create a `ppsq` user that owns it
#   2. edit the paths/user below if you used different ones
#   3. cp deploy/ppsq.service /etc/systemd/system/ppsq.service
#   4. systemctl daemon-reload && systemctl enable --now ppsq
#
# IMPORTANT: single process only. Do NOT template this into multiple instances or add
# web-server workers — the background job queue and SQLite live in-process (see AGENTS.md).

[Unit]
Description=PPS Quarantine Manager
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=ppsq
Group=ppsq
WorkingDirectory=/opt/ppsq
ExecStart=/opt/ppsq/venv/bin/python wsgi.py
Restart=on-failure
RestartSec=5

# Config path is optional: the app defaults to ./config.toml in WorkingDirectory.
# Uncomment to point elsewhere:
# Environment=PPSQ_CONFIG=/etc/ppsq/config.toml

# --- modest hardening (safe defaults; remove any that get in your way) ---
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
# The app rewrites config.toml + writes jobs.db/*.log in WorkingDirectory, so it must be
# writable. If ProtectSystem hides it, grant it explicitly:
ReadWritePaths=/opt/ppsq

[Install]
WantedBy=multi-user.target