deploy/git-trace.service

# /etc/systemd/system/git-trace.service
# Forge HTTP daemon — loopback only, Caddy terminates TLS in front.
[Unit]
Description=git-trace forge
After=network.target

[Service]
Type=simple
User=git
Group=git
Environment=GIT_TRACE_REPOS=/srv/git-trace/repos
Environment=GIT_TRACE_DB=/srv/git-trace/var/git-trace.db
# EDIT: set to the final public origin once DNS points here
Environment=GIT_TRACE_BASE_URL=https://git.example.com
Environment=GIT_TRACE_NAME=git-trace
Environment=GIT_TRACE_SSH_URL=ssh://git@git.example.com:2222
# Environment=GIT_TRACE_OPEN_REG=1        # enable only with a portal in front
Environment=GIT_TRACE_TIER_GATE=0
ExecStart=/usr/local/bin/git-trace serve -p 8081
Restart=on-failure
RestartSec=2

# hardening — the daemon only ever writes under /srv/git-trace
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/srv/git-trace /tmp
ProtectHome=true
PrivateTmp=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
MemoryMax=1G

[Install]
WantedBy=multi-user.target