[Unit]
Description=Telegram task earning worker
Wants=network-online.target
After=network-online.target
StartLimitIntervalSec=120
StartLimitBurst=5

[Service]
Type=simple
User=taskapp
Group=taskapp
WorkingDirectory=/srv/task-app/current
EnvironmentFile=/etc/task-app/app.env
ExecStart=/usr/bin/node /srv/task-app/current/worker.js
Restart=on-failure
RestartSec=5
KillSignal=SIGTERM
TimeoutStopSec=45
UMask=0077
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/srv/task-app/storage
RestrictSUIDSGID=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
CapabilityBoundingSet=
LimitNOFILE=65536
MemoryMax=1G
TasksMax=256
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target