[Unit]
Description=webui4frpc - visual frpc controller (cluster node)
Documentation=https://gitcode.com/JianFeeeee/webui4frpc
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=webui4frpc
Group=webui4frpc
# The listening address, admin credentials and cluster peers live in
# config.json, NOT on the command line: anything in ExecStart is visible to
# every user via `ps` and in the unit file itself. Keep the password out of
# this unit — put it in config.json as "file:/etc/webui4frpc/secret/password"
# (or "${W4F_PASSWORD}" with an EnvironmentFile), never as -password.
# The leading "-" makes the EnvironmentFile optional, so a node that keeps all
# settings in config.json still starts.
EnvironmentFile=-/etc/webui4frpc/webui4frpc.env
ExecStart=/usr/bin/webui4frpc -config /etc/webui4frpc/config.json
Restart=always
RestartSec=5
LimitNOFILE=65535

# hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
ReadWritePaths=/var/lib/webui4frpc
# config.json may point at a root-only secrets file for the admin password.
# That path needs to be readable by this service account; keep such files in
# /etc/webui4frpc/secret/ with mode 0640 root:webui4frpc.
ReadOnlyPaths=-/etc/webui4frpc/secret

[Install]
WantedBy=multi-user.target