[Unit]
Description=Credential Vault Server (KeePassXC WebSocket Interface)
Documentation=file:///home/theflow/projects/tractatus/.credential-vault/README.md
After=network.target

[Service]
Type=simple
WorkingDirectory=/home/theflow/projects/tractatus/.credential-vault

# Start the Node.js server
ExecStart=/usr/bin/node server.js

# Restart policy - always restart on failure
Restart=always
RestartSec=10

# Security hardening
NoNewPrivileges=true
PrivateTmp=true

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=credential-vault

# Resource limits (optional - adjust as needed)
MemoryLimit=512M
CPUQuota=50%

[Install]
WantedBy=default.target