[Unit]
Description=peardock HyperDHT Docker control plane
Documentation=https://github.com/holepunchto/peardock
After=docker.service network-online.target
Wants=network-online.target
Requires=docker.service

[Service]
Type=simple
WorkingDirectory=/opt/peardock
ExecStart=/usr/bin/node server/server.js
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=5
# Health: process must stay up; optional external check via scripts/healthcheck.js
TimeoutStartSec=30
TimeoutStopSec=30

# Security hardening (adjust paths as needed)
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=read-only
ReadWritePaths=/opt/peardock /var/run/docker.sock

# Environment
Environment=NODE_ENV=production
EnvironmentFile=-/opt/peardock/.env
# Example production knobs (uncomment / set in .env):
# Environment=PEARDOCK_DEFAULT_ROLE=operator
# Environment=PEARDOCK_PEER_ALLOWLIST=1
# Environment=PEARDOCK_BROWSE_ROOTS=/var/lib/docker/volumes
# Environment=ENABLE_SWARM=0
# Environment=ENABLE_PLUGINS=0

# Run as a dedicated user with docker group access
User=peardock
Group=docker

[Install]
WantedBy=multi-user.target