# Cashumints.space Workers - Systemd Service File
#
# Installation:
#   sudo cp deploy/cashumints-workers.service /etc/systemd/system/
#   sudo systemctl daemon-reload
#   sudo systemctl enable cashumints-workers
#   sudo systemctl start cashumints-workers
#
# Management:
#   sudo systemctl status cashumints-workers
#   sudo systemctl restart cashumints-workers
#   sudo journalctl -u cashumints-workers -f

[Unit]
Description=Cashumints.space Background Workers
Documentation=https://cashumints.space/docs
After=network.target cashumints-api.service
Wants=network-online.target

[Service]
Type=simple
User=cashumints
Group=cashumints
WorkingDirectory=/opt/cashumints-api

# Environment
Environment=NODE_ENV=production
EnvironmentFile=/opt/cashumints-api/.env

# Process
ExecStart=/usr/bin/node src/workers/index.js
ExecReload=/bin/kill -HUP $MAINPID

# Restart policy
Restart=always
RestartSec=10
StartLimitInterval=120
StartLimitBurst=5

# Resource limits
LimitNOFILE=65536
LimitNPROC=4096

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/cashumints-api/data
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictNamespaces=true

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=cashumints-workers

[Install]
WantedBy=multi-user.target