[Unit]
Description=SMA Core API
After=network-online.target
Wants=network-online.target
ConditionPathExists=/opt/struktur/social-media-radar/.venv/bin/gunicorn

[Service]
Type=notify
User=sma-core
Group=sma-core
WorkingDirectory=/opt/struktur/social-media-radar
EnvironmentFile=/etc/sma/sma-core.env
LoadCredential=sma-app-secret:/etc/sma/credentials/sma-app-secret
LoadCredential=sma-session-secret:/etc/sma/credentials/sma-session-secret
LoadCredential=sma-csrf-secret:/etc/sma/credentials/sma-csrf-secret
LoadCredential=sma-operator-password-hash:/etc/sma/credentials/sma-operator-password-hash
ExecStart=/usr/bin/env /opt/struktur/social-media-radar/.venv/bin/gunicorn --bind 127.0.0.1:8765 --workers 2 --timeout 45 --graceful-timeout 30 --access-logfile - sma_runtime.wsgi:app
Restart=on-failure
RestartSec=5s
TimeoutStopSec=35s
KillSignal=SIGTERM
UMask=0077
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictSUIDSGID=true
ReadWritePaths=/var/lib/sma-core /var/lib/sma-data

[Install]
WantedBy=multi-user.target