# MyDay — systemd unit (D-043: the app runs behind Zoraxy; TLS terminates there).
#
# INSTALL (as root):
#   1. build the static, CGO-free binary:
#        go build -trimpath -o /usr/local/bin/myday ./cmd/myday
#   2. create the app dir (config.yaml + data/ live there) and drop in the config:
#        install -d -o <myday-user> -g <myday-group> <app-dir>
#        install -m 0640 -o <myday-user> -g <myday-group> config.yaml <app-dir>/config.yaml
#   3. systemctl daemon-reload && systemctl enable --now myday
#
# Replace every <PLACEHOLDER> below (path placeholders must resolve to ABSOLUTE
# paths). `config.yaml` is gitignored — NEVER commit it (D-010). See
# docs/deploy-zoraxy.md for the full deployment walkthrough.

[Unit]
Description=MyDay — Sechpoint employee app
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=<myday-user>
Group=<myday-group>
WorkingDirectory=<app-dir>
# binary path, e.g. /usr/local/bin/myday (no inline comments — systemd keeps them)
ExecStart=<binary>
Environment=MYDAY_CONFIG=<app-dir>/config.yaml
Restart=on-failure
RestartSec=5s

# The binary is static and CGO-free; at runtime the app writes only config.yaml,
# data/ and the SQLite files inside WorkingDirectory (the wizard persists the
# generated secrets there). ReadWritePaths keeps `ProtectSystem=strict` from
# breaking those writes.
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ReadWritePaths=<app-dir>

[Install]
WantedBy=multi-user.target