[Unit]
Description=Lichen Appview
After=network.target

[Service]
Type=simple
User=lichen
Group=lichen
WorkingDirectory=/opt/lichen
ExecStart=/usr/local/bin/bun run src/server/index.ts
Restart=on-failure
RestartSec=5
EnvironmentFile=/etc/lichen/env

# Hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/lichen
PrivateTmp=true

[Install]
WantedBy=multi-user.target