[Unit]
Description=Bookshelf PocketBase server
After=network-online.target
Wants=network-online.target

[Service]
# Adjust to your setup: a dedicated, unprivileged system account.
# Create it once with:  sudo useradd --system --home /opt/bookshelf --shell /usr/sbin/nologin bookshelf
User=bookshelf
Group=bookshelf

# All paths below assume the whole ~/bookshelf/server tree (pocketbase binary,
# pb_data/, pb_migrations/, pb_hooks/) is deployed to /opt/bookshelf.
# Adjust WorkingDirectory/ExecStart if you deploy elsewhere.
WorkingDirectory=/opt/bookshelf
ExecStart=/opt/bookshelf/pocketbase serve \
  --http=127.0.0.1:8090 \
  --dir=/opt/bookshelf/pb_data \
  --migrationsDir=/opt/bookshelf/pb_migrations \
  --hooksDir=/opt/bookshelf/pb_hooks

Restart=always
RestartSec=5

# Hardening (safe defaults for a single-purpose service; loosen only if
# something concrete breaks).
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/bookshelf/pb_data
CapabilityBoundingSet=
AmbientCapabilities=

[Install]
WantedBy=multi-user.target