[Unit]
Description=FIGHTSKILL Gaming Platform
After=network.target postgresql.service
Wants=postgresql.service

[Service]
Type=notify
User=www-data
Group=www-data
WorkingDirectory=/var/www/fightskill
Environment="PATH=/var/www/fightskill/venv/bin:/usr/bin:/bin"
EnvironmentFile=/var/www/fightskill/.env
ExecStart=/var/www/fightskill/venv/bin/gunicorn \
    --workers 4 \
    --threads 2 \
    --bind 127.0.0.1:8000 \
    --timeout 120 \
    --access-logfile /var/log/fightskill/access.log \
    --error-logfile /var/log/fightskill/error.log \
    run:app
ExecReload=/bin/kill -s HUP $MAINPID
KillMode=mixed
KillSignal=SIGTERM
TimeoutStopSec=30
Restart=on-failure
RestartSec=5s
StandardOutput=journal
StandardError=journal
SyslogIdentifier=fightskill

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/www/fightskill/app/static/uploads
ReadWritePaths=/var/log/fightskill
MemoryMax=512M

[Install]
WantedBy=multi-user.target