[Unit]
Description=Prospect Platform API (portable systemd/Virtualmin example)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=prospect
Group=prospect
WorkingDirectory=/srv/prospect-platform/apps/api
EnvironmentFile=-/etc/prospect-platform/prospect.env
ExecStart=/usr/bin/python3 /srv/prospect-platform/apps/api/app/main.py --host 127.0.0.1 --port 8000 --db /var/lib/prospect-platform/prospects.db
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/prospect-platform
UMask=0077

[Install]
WantedBy=multi-user.target

# Virtualmin: create the prospect user/domain, place the EnvironmentFile outside
# public_html, and use this unit (or its ExecStart/Restart settings) as the
# service command. Put TLS/reverse proxying in the Virtualmin-managed web tier.