[Unit]
Description=SVOS front door (Caddy, tailnet-only, svos.phasefinal.com) - eshpfi configs/svos-front
After=network-online.target tailscaled.service
Wants=network-online.target tailscaled.service

[Service]
User=caddy
Group=caddy
EnvironmentFile=/etc/caddy/env
ExecStart=/usr/local/bin/caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
ExecReload=/usr/local/bin/caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile
AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/caddy
Environment=XDG_DATA_HOME=/var/lib/caddy XDG_CONFIG_HOME=/var/lib/caddy
# the tailnet address may not exist yet right after boot: keep retrying the bind
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target