# deploy/mapserver.service
# ~/.config/systemd/user/mapserver.service
#
#   systemctl --user daemon-reload
#   systemctl --user enable --now mapserver
#
# Requires: loginctl enable-linger <user>
# Without linger, user units do not start at boot and are killed on logout.

[Unit]
Description=Waymark mapping server
# Quadlet generates postgres.service from postgres.container.
# Both must be USER units for this ordering to work.
After=postgres.service
Wants=postgres.service

[Service]
Type=simple
EnvironmentFile=%h/.config/mapserver/.env
WorkingDirectory=%h
ExecStart=%h/.local/bin/rs_maps
Restart=on-failure
RestartSec=5

# After= does not mean Postgres is accepting connections; the binary retries
# its initial pool connection with backoff, so this only catches hard failures.

NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=%h/gpx
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictSUIDSGID=true
MemoryDenyWriteExecute=true

[Install]
WantedBy=default.target