[Unit]
Description=PAC Service (NestJS API + Cron + BullMQ Worker)
After=network.target postgresql.service redis.service

[Service]
Type=simple
User=pac
Group=pac
WorkingDirectory=/opt/pac/apps/pac-service
EnvironmentFile=/opt/pac/apps/pac-service/.env
ExecStart=/usr/bin/node --enable-source-maps dist/main.js
Restart=on-failure
RestartSec=5s
StandardOutput=append:/var/log/pac/pac-service.log
StandardError=append:/var/log/pac/pac-service.error.log

# 安全加固
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true

[Install]
WantedBy=multi-user.target
