[Unit]
Description=Fortnox Flask API (Gunicorn)
After=network.target

[Service]
# Run as web server user
User=www-data
Group=www-data

# Where your backend code lives
WorkingDirectory=/var/www/fortnox.synktek.com/backend

# Virtualenv
Environment="PATH=/var/www/fortnox.synktek.com/backend/venv/bin"

# Optional env file (won't crash if missing)
EnvironmentFile=-/var/www/fortnox.synktek.com/backend/.env

# Prevent writing __pycache__ into repo
Environment=PYTHONDONTWRITEBYTECODE=1

# Create /run/fortnox automatically
RuntimeDirectory=fortnox
RuntimeDirectoryMode=0755

# Start Gunicorn
ExecStart=/var/www/fortnox.synktek.com/backend/venv/bin/gunicorn \
  --workers 3 \
  --bind 127.0.0.1:8000 \
  --chdir /var/www/fortnox.synktek.com/backend \
  --worker-tmp-dir /dev/shm \
  --pid /run/fortnox/gunicorn.pid \
  --control-socket /run/fortnox/gunicorn.ctl \
  --timeout 600 \
  --keep-alive 30 \
  wsgi:application

# Reliability
Restart=always
RestartSec=3

# Security hardening (safe defaults)
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true

[Install]
WantedBy=multi-user.target