[Unit]
Description=ERP push-to-deploy webhook receiver (Gitea -> docker compose)
After=network-online.target docker.service
Wants=network-online.target

[Service]
# Run as a dedicated non-root user with docker group membership:
#   sudo useradd -r -s /usr/sbin/nologin erpdeploy && sudo usermod -aG docker erpdeploy
#   sudo chown -R erpdeploy /srv/erp
User=erpdeploy
Group=erpdeploy
WorkingDirectory=/srv/erp
# EnvironmentFile carries GITEA_WEBHOOK_SECRET (same .env used by compose).
EnvironmentFile=/srv/erp/.env
ExecStart=/usr/bin/python3 /srv/erp/infra/deploy-webhook/deploy_webhook.py
Restart=on-failure
RestartSec=5
# Minimal exposure: no write access outside /srv/erp, no new privileges.
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/srv/erp /tmp
ProtectHome=true

[Install]
WantedBy=multi-user.target