[Unit]
Description=Veille IA — observatoire de veille sur les modèles IA (SvelteKit)
After=network.target

[Service]
Type=simple
User=__APP__
Group=__APP__
WorkingDirectory=__INSTALL_DIR__/app

Environment="PATH=__PATH_WITH_NODEJS__"
Environment="NODE_ENV=production"
Environment="HOST=127.0.0.1"
Environment="PORT=__PORT__"
Environment="ORIGIN=https://__DOMAIN____PATH__"
# DATA_DIR, OLLAMA_URL, ALERTS_TOKEN (fichier posé à l'install, chmod 400)
EnvironmentFile=__INSTALL_DIR__/app/.env

ExecStart=__NODEJS_DIR__/node build/index.js

# Logs vers journald : yunohost service log __APP__
StandardOutput=journal
StandardError=journal
SyslogIdentifier=__APP__

# Sandboxing (niveau modéré : le service doit pouvoir lancer git dans le data_dir,
# phase 1 — simple-git — et joindre Ollama en HTTP sortant).
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
LockPersonality=yes
SystemCallArchitectures=native
CapabilityBoundingSet=

[Install]
WantedBy=multi-user.target