[Unit]
Description=HAN Chat VM1 root Compose stack (%i)
Requires=docker.service han-secrets@%i.service
After=docker.service han-secrets@%i.service network-online.target
Wants=network-online.target
ConditionPathIsDirectory=/opt/han-chat/current/backend

[Service]
Type=oneshot
RemainAfterExit=yes
User=root
Group=root
WorkingDirectory=/opt/han-chat/current/backend
ExecStart=/usr/local/sbin/han-vm1-compose up -d --remove-orphans
ExecReload=/usr/local/sbin/han-vm1-compose up -d --remove-orphans
ExecStop=/usr/local/sbin/han-vm1-compose stop
TimeoutStartSec=600
TimeoutStopSec=180
UMask=0077
NoNewPrivileges=yes
PrivateTmp=yes
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
LimitCORE=0

[Install]
WantedBy=multi-user.target