[Unit]
Description=dev-blog Astro application (node:24-trixie-slim)
Wants=network-online.target
After=network-online.target

[Container]
ContainerName=dev-blog-app
# Built from the Containerfile at the repo root.
# Build with:   podman build -t localhost/dev-blog-app:latest .
Image=localhost/dev-blog-app:latest

Network=dev-blog.network
NetworkAlias=app

Environment=NODE_ENV=production
Environment=HOST=0.0.0.0
Environment=PORT=4321
Environment=ASTRO_TELEMETRY_DISABLED=1

# Hardening
NoNewPrivileges=true
ReadOnly=true
DropCapability=ALL
Tmpfs=/tmp:rw,size=64m,mode=1777

# Caddy now runs on the host network namespace, so it cannot reach the app
# via podman DNS (`app:4321`). Publish the app port on the host's *loopback*
# only -- it is reachable to Caddy on the host but not from outside.
PublishPort=127.0.0.1:4321:4321
PublishPort=[::1]:4321:4321

[Service]
Restart=on-failure
TimeoutStartSec=120

[Install]
WantedBy=multi-user.target default.target