[Unit]
Description=pnpr - pnpm-compatible npm registry server
Documentation=https://pnpm.io/pnpr
After=network-online.target
Wants=network-online.target
ConditionPathExists=/etc/pnpr/pnpr.yaml

[Service]
Type=simple
User=pnpr
Group=pnpr

# Hosted/published packages (config storage:) persist in /var/lib/pnpr;
# the disposable mirror of upstream registries goes to /var/cache/pnpr
# (--cache) and can be wiped at any time.
StateDirectory=pnpr
StateDirectoryMode=0750
CacheDirectory=pnpr
CacheDirectoryMode=0750

EnvironmentFile=/etc/pnpr/pnpr.env
ExecStart=/usr/bin/pnpr -c /etc/pnpr/pnpr.yaml --cache /var/cache/pnpr --listen ${PNPR_LISTEN} $PNPR_OPTS

Restart=on-failure
RestartSec=5s

# Hardening
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6

[Install]
WantedBy=multi-user.target