[Unit]
Description=Timer App - Zeiterfassung
Documentation=file:///opt/timer-app/DEPLOY.md
After=network.target

[Service]
Type=simple

# --- Anpassen ---------------------------------------------------------------
WorkingDirectory=/opt/timer-app/backend
ExecStart=/usr/bin/node server.js
User=timerapp
Group=timerapp
# ----------------------------------------------------------------------------

Restart=always
RestartSec=10

Environment=NODE_ENV=production
# Zeitzone bestimmt die Tagesgrenzen im Historien-Filter
Environment=TZ=Europe/Berlin

# Ausgabe landet im Journal:  journalctl -u timer-app -f
StandardOutput=journal
StandardError=journal

# --- Härtung ----------------------------------------------------------------
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictNamespaces=true
LockPersonality=true

# Einziger Pfad mit Schreibrecht: das Datenverzeichnis
ReadWritePaths=/opt/timer-app/data

LimitNOFILE=4096

[Install]
WantedBy=multi-user.target