[Unit]
Description=BAMS Backend Service
Documentation=https://github.com/bams/bams
After=network.target

[Service]
Type=simple
User=bams
Group=bams
WorkingDirectory=/var/lib/bams
ExecStart=/usr/local/bin/bams-backend
Restart=on-failure
RestartSec=5s
StandardOutput=journal
StandardError=journal
SyslogIdentifier=bams

# Security settings
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/bams /etc/bams

# Environment
Environment="BAMS_CONFIG=/etc/bams/config.yaml"
Environment="BAMS_PORT=8080"
Environment="BAMS_LOG_LEVEL=info"

[Install]
WantedBy=multi-user.target