[Unit]
Description=Thermograph (FastAPI/uvicorn)
After=network-online.target
Wants=network-online.target

[Service]
Type=exec
User=deploy
Group=deploy
# The repo checkout. uvicorn is run from backend/ so `app:app` resolves.
WorkingDirectory=/opt/thermograph/backend
# THERMOGRAPH_BASE, PORT, etc. See deploy/thermograph.env.example.
EnvironmentFile=/etc/thermograph.env
# Bind loopback only — Caddy terminates TLS and reverse-proxies to us.
ExecStart=/opt/thermograph/.venv/bin/uvicorn app:app --host 127.0.0.1 --port ${PORT}
Restart=on-failure
RestartSec=2
# Hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=read-only
# The parquet cache must stay writable across deploys.
ReadWritePaths=/opt/thermograph/data /opt/thermograph/logs

[Install]
WantedBy=multi-user.target