# ================================================================
# GitLink Community Ops — Webhook Listener Systemd Service
#
# 安装:
#   sudo cp gitlink-webhook.service /etc/systemd/system/
#   sudo systemctl daemon-reload
#   sudo systemctl enable --now gitlink-webhook
#
# 管理:
#   sudo systemctl status gitlink-webhook   # 查看状态
#   sudo systemctl restart gitlink-webhook  # 重启
#   sudo journalctl -u gitlink-webhook -f   # 查看日志
# ================================================================
[Unit]
Description=GitLink Community Ops Webhook Listener
Documentation=https://github.com/your-org/gitlink-cli
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=gitlink
Group=gitlink
WorkingDirectory=/opt/gitlink-webhook
EnvironmentFile=/opt/gitlink-webhook/.env
ExecStart=/usr/bin/python3 /opt/gitlink-webhook/01a-webhook-listener.py
Restart=always
RestartSec=10
StandardOutput=journal
StandardError=journal

# 安全加固
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/opt/gitlink-webhook/webhook-logs
ReadOnlyPaths=/opt/gitlink-webhook/workflows

[Install]
WantedBy=multi-user.target
