[Unit]
Description=cnats - web chat over NATS subjects with Kanidm SSO
Documentation=https://prosjekt.klingenbergbygg.no/bl/cnats
After=network-online.target nats-server.service postgresql.service
Wants=network-online.target

[Service]
DynamicUser=yes
EnvironmentFile=/etc/cnats/env
Environment=LEPTOS_SITE_ROOT=/usr/share/cnats/site
ExecStart=/usr/bin/cnats
Restart=on-failure
RestartSec=5

# Hardening: the app only needs outbound sockets and its static site dir.
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
CapabilityBoundingSet=

[Install]
WantedBy=multi-user.target