[Unit]
Description=wireguard-ui - WireGuard management UI
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
# Runs as root because it shells out to wg-quick / wg, which need
# CAP_NET_ADMIN in practice (and wg-quick itself needs broad privileges).
User=root
Group=root
AmbientCapabilities=CAP_NET_ADMIN
# wireguard-ui reads/writes ./db relative to the working directory.
WorkingDirectory=/var/lib/wireguard-ui-multi
Environment=BIND_ADDRESS=0.0.0.0:5000
ExecStart=/usr/local/bin/wireguard-ui
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target