[Unit]
Description=Quake 4 browser gateway and authoritative OpenQ4 server
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=q4
Group=q4
WorkingDirectory=/srv/q4
UMask=0027
Environment=NODE_ENV=production
Environment=HOME=/srv/q4/runtime/native/home
Environment=XDG_DATA_HOME=/srv/q4/runtime/native/home
Environment=HOST=0.0.0.0
Environment=PORT=3280
Environment=Q4_GAME_PORT=28004
Environment=Q4_SPAWN_DEDICATED=1
Environment=Q4_REPLAY_DIR=/srv/q4/replays
Environment=Q4_REPLAY_RETENTION=300
Environment=Q4_REPLAY_PLAYBACK=1
Environment=Q4_REPLAY_PORTS=28040,28041,28042,28043,28044,28045,28046,28047
Environment=Q4_REPLAY_HOME_ROOT=/srv/q4/runtime/replay-instances
Environment=Q4_REPLAY_START_TIMEOUT_MS=120000
Environment=Q4_CROSS_ORIGIN_ISOLATION=1
Environment=Q4_TRUSTED_PROXIES=127.0.0.1,::1,10.6.0.105
Environment=Q4_RETAIL_DELIVERY=operator-authorized
Environment=Q4_RETAIL_DIR=/srv/q4/assets-src/gog/q4base
Environment=Q4_RETAIL_MANIFEST=/srv/q4/runtime/retail-manifest.json
Environment=Q4_RETAIL_BUNDLE_DIR=/srv/q4/runtime/retail-bundles
Environment=Q4_RETAIL_BUNDLE_MANIFEST=/srv/q4/runtime/retail-bundle-manifest.json
Environment=Q4_RETAIL_MAX_CONCURRENT=16
Environment=Q4_RETAIL_MAX_PER_IP=2
ExecStart=/usr/bin/node /srv/q4/server.js
Restart=on-failure
RestartSec=3
TimeoutStopSec=20
KillMode=mixed
LimitNOFILE=65536
TasksMax=256

# Node and the OpenQ4 children may write only saves, finalized recordings, and
# isolated replay-instance homes. Everything else, including retail data, is read-only.
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/srv/q4/replays
ReadWritePaths=/srv/q4/runtime/native/home
ReadWritePaths=/srv/q4/runtime/replay-instances
CapabilityBoundingSet=
AmbientCapabilities=
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectKernelLogs=true
ProtectClock=true
ProtectHostname=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
LockPersonality=true
RemoveIPC=true
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target
