[Unit]
Description=xiangqin FastAPI server
After=network.target

[Service]
Type=simple
User=xiangqin
Group=xiangqin
WorkingDirectory=/opt/xiangqin
Environment="PATH=/opt/xiangqin/.venv/bin:/usr/bin:/bin"
Environment="XIANGQIN_SMS_PROVIDER=aliyun"
Environment="XIANGQIN_PAYMENT_PROVIDER=alipay"
Environment="XIANGQIN_BASE_URL=https://xq.agentaily.com"
Environment="VAULT_DATA_DIR=/opt/xiangqin/vault-data"
Environment="XIANGQIN_OSS_BUCKET=agentaily-xiangqin-photos-prod"
Environment="XIANGQIN_OSS_ENDPOINT=oss-cn-hangzhou.aliyuncs.com"
# 敏感凭证（AK/SK）走 EnvironmentFile 而非 Environment=（-前缀 = 文件不存在时 OK）
EnvironmentFile=-/opt/xiangqin/.env
# data 目录隔离 + systemd 沙箱强化
ReadWritePaths=/opt/xiangqin/data /opt/xiangqin/logs
ProtectSystem=strict
ProtectHome=true
NoNewPrivileges=true
PrivateTmp=true
ExecStart=/opt/xiangqin/.venv/bin/uvicorn xiangqin.app:app --host 127.0.0.1 --port 8000
Restart=on-failure
RestartSec=5
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
