[Unit]
Description=Osiris — cat medication and pulse tracking
After=network.target

[Service]
Type=notify
User=__USER__
WorkingDirectory=__PROJECT_DIR__
EnvironmentFile=__PROJECT_DIR__/.env
# --no-sync: 'make install' already synced. Without it, uv would try to resolve
# dependencies at boot, which needs the network and can fail at the worst moment.
ExecStart=__UV__ run --no-sync gunicorn osiris.wsgi:application \
    --bind 127.0.0.1:__PORT__ \
    --workers 2 \
    --access-logfile - \
    --error-logfile -
Restart=on-failure
RestartSec=5s

# SQLite and the media/static dirs are the only things it needs to write.
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=read-only
ReadWritePaths=__PROJECT_DIR__

[Install]
WantedBy=multi-user.target