[Unit]
Description=Guanghu Lake Lamp email-link authorization service
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=guanghu-authz
Group=guanghu-authz
WorkingDirectory=/opt/guanghu/lake-lamp-authz
EnvironmentFile=/etc/guanghu/secrets/lake-lamp/authorization.env
ExecStart=/usr/bin/node /opt/guanghu/lake-lamp-authz/server.js
Restart=on-failure
RestartSec=3
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/guanghu/lake-lamp-authz /var/lib/guanghu/repo-authorizations /var/lib/guanghu/repo-push-uploads /var/lib/guanghu/forgejo/repositories/bingshuo/hololake-platform.git /var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git
ReadOnlyPaths=-/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/hololake-knowledge-base.git -/etc/guanghu/secrets/hololake-ai-providers.json
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
LockPersonality=true

[Install]
WantedBy=multi-user.target