[Unit]
Description=SmartBotic Database Service
Documentation=https://github.com/smartbotic/smartbotic-crm
After=network.target
Wants=network-online.target

[Service]
Type=simple
User=smartbotic
Group=smartbotic
WorkingDirectory=/opt/smartbotic

# Main executable
ExecStart=/opt/smartbotic/bin/smartbotic-db --config /etc/smartbotic/smartbotic-db.yaml

# Graceful shutdown handling
ExecStop=/bin/kill -SIGTERM $MAINPID
TimeoutStopSec=30
KillMode=mixed
KillSignal=SIGTERM

# Restart policy
Restart=on-failure
RestartSec=5
StartLimitIntervalSec=60
StartLimitBurst=3

# Security hardening
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes

# Allow write access to data directory
ReadWritePaths=/var/lib/smartbotic

# Environment variables for secrets (can be overridden in drop-in files)
# Create /etc/systemd/system/smartbotic-db.service.d/encryption.conf with:
# [Service]
# Environment="SMARTBOTIC_DB_ENCRYPTION_KEY=your-base64-key"
Environment="SMARTBOTIC_DB_DATA_DIR=/var/lib/smartbotic"
Environment="SMARTBOTIC_DB_LOG_LEVEL=info"

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=smartbotic-db

[Install]
WantedBy=multi-user.target