add production readiness and recovery assets

systemd/prospect-api.service.example

@@ -0,0 +1,27 @@
+[Unit]
+Description=Prospect Platform API (portable systemd/Virtualmin example)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=prospect
+Group=prospect
+WorkingDirectory=/srv/prospect-platform/apps/api
+EnvironmentFile=-/etc/prospect-platform/prospect.env
+ExecStart=/usr/bin/python3 /srv/prospect-platform/apps/api/app/main.py --host 127.0.0.1 --port 8000 --db /var/lib/prospect-platform/prospects.db
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/prospect-platform
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target
+
+# Virtualmin: create the prospect user/domain, place the EnvironmentFile outside
+# public_html, and use this unit (or its ExecStart/Restart settings) as the
+# service command. Put TLS/reverse proxying in the Virtualmin-managed web tier.