[Unit]
Description=Buildfor Life Budget App
After=network.target postgresql.service

[Service]
Type=simple
User=budget-app
Group=budget-app
WorkingDirectory=/opt/buildfor-life-budget
EnvironmentFile=/opt/buildfor-life-budget/.env
ExecStart=/usr/bin/node build
Restart=on-failure
RestartSec=5
StandardOutput=journal
StandardError=journal
SyslogIdentifier=b4l-budget

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/buildfor-life-budget
PrivateTmp=true

[Install]
WantedBy=multi-user.target