[Unit]
Description=Ticketing System API (Go Backend)
Documentation=https://github.com/your-org/ticketing-system
After=network.target postgresql.service
Wants=postgresql.service

[Service]
Type=simple
User=www-data
Group=www-data
WorkingDirectory=/opt/ticketing-api

# Environment file
EnvironmentFile=/opt/ticketing-api/.env

# Main executable
ExecStart=/opt/ticketing-api/api
ExecReload=/bin/kill -HUP $MAINPID

# Restart behavior
Restart=always
RestartSec=10

# Security hardening
NoNewPrivileges=true
ProtectSystem=full
ProtectHome=true
PrivateTmp=true
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE

# File descriptor limit
LimitNOFILE=65536

# Process management
TimeoutStartSec=30
TimeoutStopSec=10
KillMode=mixed
KillSignal=SIGTERM

# Logging
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target