[Unit]
Description=Dune server management service (Rust)
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/opt/dune-server-service/dune-server-service
Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/dune/.local/bin"
Environment="DUNE_DASHBOARD_PORT=29187"
Environment="DUNE_SERVICE_HOME=/home/dune"
EnvironmentFile=-/etc/dune-server-service.env
Restart=on-failure
RestartSec=10
User=dune
Group=dune

ReadWritePaths=/home/dune/.dune /home/dune/.local /home/dune/.steam /home/dune/Steam /tmp -/funcom/artifacts/database-dumps
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
RestrictRealtime=true
LockPersonality=true
NoNewPrivileges=false
MemoryDenyWriteExecute=false
# steamcmd's bundled 32-bit steamclient.so requires writable text relocations
# (dlmopen -> mprotect PROT_WRITE). Keep MemoryDenyWriteExecute explicitly
# disabled so scheduled update checks can run under systemd.

[Install]
WantedBy=multi-user.target
