[Unit]
Description=WebGPU Portfolio webhook receiver
After=network.target docker.service
Requires=docker.service

[Service]
Type=simple
User=djoser
WorkingDirectory=/home/djoser/webgpu-portfolio
EnvironmentFile=/home/djoser/webgpu-portfolio/.env
ExecStart=/usr/bin/python3 /home/djoser/webgpu-portfolio/webhook/server.py
Restart=always
RestartSec=5

# Security hardening
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/home/djoser/webgpu-portfolio
ReadOnlyPaths=/var/run/docker.sock

[Install]
WantedBy=multi-user.target