[Unit]
Description=Turborepo Remote Cache server
Documentation=https://github.com/ducktors/turborepo-remote-cache
After=network.target

[Service]
Type=simple
User=turbo-cache
Group=turbo-cache
EnvironmentFile=/etc/turborepo-remote-cache/config.env
ExecStart=/usr/bin/node --enable-source-maps /usr/lib/node_modules/turborepo-remote-cache/dist/index.js
Restart=on-failure
RestartSec=5s

# Hardening
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
ReadWritePaths=/var/cache/turborepo-remote-cache

[Install]
WantedBy=multi-user.target