# VLog Public API Service Template
# Copy to /etc/systemd/system/vlog-public.service and customize:
#   - Replace <YOUR_USER> with your username
#   - Replace /path/to/vlog with your installation path
#   - Replace <PROXY_IP> with your reverse proxy IP (or remove if not using proxy)
#   - Adjust storage path if not using /mnt/nas/vlog-storage

[Unit]
Description=VLog Public API
After=network.target postgresql.service mnt-nas.mount
Wants=mnt-nas.mount postgresql.service

StartLimitIntervalSec=300
StartLimitBurst=5

[Service]
Type=simple
User=<YOUR_USER>
Group=<YOUR_USER>
WorkingDirectory=/path/to/vlog
EnvironmentFile=/path/to/vlog/.env
ExecStart=/path/to/vlog/venv/bin/python -m uvicorn api.public:app --host 0.0.0.0 --port 9000 --proxy-headers --forwarded-allow-ips='127.0.0.1,<PROXY_IP>'

# Security hardening
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
NoNewPrivileges=true
CapabilityBoundingSet=
AmbientCapabilities=

# Allowed paths (NAS storage and working directory)
ReadWritePaths=/path/to/vlog /mnt/nas/vlog-storage

# Resource limits
LimitNOFILE=65535
MemoryMax=2G

# Restart policy
Restart=on-failure
RestartSec=5

# Timeouts
TimeoutStartSec=30
TimeoutStopSec=30

[Install]
WantedBy=multi-user.target