[Unit]
Description=Tilbudgivern Application (Secure)
After=network.target
Wants=network-online.target

[Service]
Type=forking
User=root
WorkingDirectory=/mnt/HC_Volume_103713257/tilbudgivern

# Decrypt environment files before starting
ExecStartPre=/mnt/HC_Volume_103713257/tilbudgivern/scripts/decrypt-env.sh

# Start backend as alex user
ExecStart=/bin/su - alex -c "cd /mnt/HC_Volume_103713257/tilbudgivern/backend && npm start"

# Cleanup decrypted files on stop
ExecStopPost=/mnt/HC_Volume_103713257/tilbudgivern/scripts/decrypt-env.sh --cleanup

# Security settings
ProtectSystem=strict
ProtectHome=true
NoNewPrivileges=true
PrivateTmp=true

# Restart policy
Restart=on-failure
RestartSec=10s

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=tilbudgivern

[Install]
WantedBy=multi-user.target