[Unit]
Description=diff.sr.ht git diff/compare viewer
After=network.target

[Service]
Type=simple
# Runs as the git user so it has read access to the bare repositories under
# /var/lib/git. diff.sr.ht is stateless — no database or Redis dependency.
User=git
Restart=always
ExecStart=/usr/local/bin/comparesrht -b 127.0.0.1:5090

# core-go's server.Run performs its warm shutdown on SIGINT (the SourceHut
# fleet convention), not the systemd default SIGTERM. Send SIGINT on stop so
# `systemctl stop`/restart drains in-flight requests instead of hard-killing.
KillSignal=SIGINT
TimeoutStopSec=35

# The service only ever reads: bare repos on disk and the shared config. It
# writes nothing, so lock the filesystem down.
ProtectSystem=strict
ProtectHome=true
ReadOnlyPaths=/var/lib/git
PrivateTmp=true
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target