[Unit]
Description=DECNET Web Dashboard Service
After=network.target decnet-api.service

[Service]
Type=simple
User=decnet
Group=decnet
WorkingDirectory=/path/to/DECNET
# Ensure environment is loaded from the .env file
EnvironmentFile=/path/to/DECNET/.env
# Use the virtualenv python to run the decnet web command
ExecStart=/path/to/DECNET/.venv/bin/decnet web

# The Web Dashboard service does not require network administration privileges.
# Enable the following lines if you wish to bind the Dashboard to a privileged port (e.g., 80 or 443) 
# while still running as a non-root user.
# CapabilityBoundingSet=CAP_NET_BIND_SERVICE
# AmbientCapabilities=CAP_NET_BIND_SERVICE

# Security Hardening
NoNewPrivileges=yes
ProtectSystem=full
ProtectHome=read-only

Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target