# Installed at /etc/systemd/system/helpdesk.service. Runs the WEBrick backend as a dedicated system
# user, bound to loopback (nginx is the only public entry). LANG/LC_ALL are required — Czech text breaks
# under a non-UTF-8 locale. Secrets come from /etc/helpdesk/env (root-only).
[Unit]
Description=Helpdesk console + device API (WEBrick, PostgreSQL)
After=network-online.target postgresql.service
Wants=network-online.target

[Service]
Type=simple
User=helpdesk
Group=helpdesk
WorkingDirectory=/srv/helpdesk/components/backend
EnvironmentFile=/etc/helpdesk/env
Environment=LANG=C.UTF-8
Environment=LC_ALL=C.UTF-8
ExecStart=/usr/bin/ruby /srv/helpdesk/components/backend/server.rb
Restart=on-failure
RestartSec=3
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
StateDirectory=helpdesk

[Install]
WantedBy=multi-user.target