[Unit]
Description=eaisalestrain 博昇内部培训平台后端
After=network.target
Wants=network.target

[Service]
Type=simple
User=eaisalestrain
Group=eaisalestrain
WorkingDirectory=/opt/eaisalestrain
EnvironmentFile=-/opt/eaisalestrain/.env
ExecStart=/opt/eaisalestrain/eaisalestrain-server
Restart=always
RestartSec=3

# 交付专用设备：最小权限 + 只读加固
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/eaisalestrain/data
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true

# 端口占用到 8080 后自动释放，方便运维
KillMode=mixed
TimeoutStopSec=30

[Install]
WantedBy=multi-user.target