# /etc/systemd/system/exo@.service
# One template unit for all four landings: systemctl enable --now exo@fitnes
[Unit]
Description=EXO landing API (%i)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=exo
Group=exo
WorkingDirectory=/srv/exo/%i/current
EnvironmentFile=/etc/exo/%i.env
# The server is TypeScript run directly by tsx — there is no server build step.
ExecStart=/srv/exo/%i/current/node_modules/.bin/tsx server/src/index.ts
Restart=always
RestartSec=2
SyslogIdentifier=exo-%i

# Sandbox. The process only reads from /srv/exo and talks HTTPS to amocrm.ru.
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictSUIDSGID=true
LockPersonality=true
# Backstop, not a tuning target: expected RSS is 60-100 MB.
MemoryMax=512M
TasksMax=256

[Install]
WantedBy=multi-user.target