[Unit]
Description=DRE Customer Portal API (FastAPI/uvicorn)
After=network.target

[Service]
Type=simple
WorkingDirectory=/opt/dre-portal
EnvironmentFile=/opt/dre-portal/.env
ExecStart=/opt/dre-portal/venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8093
Restart=on-failure
RestartSec=3
User=root
# hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ReadWritePaths=/opt/dre-portal/data
# NOTE: ProtectHome=true would block reading /root; omitted so service can read env.
# (ops-portal.service runs as root without ProtectHome for the same reason.)

[Install]
WantedBy=multi-user.target