[Unit]
Description=wireguard-ui-multi - native multi-server WireGuard management UI
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
# Runs as root because it shells out to wg-quick, systemctl and nft, which
# require CAP_NET_ADMIN (and in practice broad privileges for systemctl unit
# management). AmbientCapabilities is set as defense-in-depth in case this
# unit is ever adapted to run as a non-root user with File capabilities on
# the binary instead.
User=root
Group=root
AmbientCapabilities=CAP_NET_ADMIN
ExecStart=/usr/local/bin/wireguard-ui-multi --db /var/lib/wireguard-ui-multi/wireguard-ui-multi.db --config-dir /etc/wireguard --hooks-dir /etc/wireguard-manager/hooks
Restart=on-failure
RestartSec=5
WorkingDirectory=/var/lib/wireguard-ui-multi

[Install]
WantedBy=multi-user.target