# /etc/systemd/system/pn.service
[Unit]
Description=Pure Note - minimalist high-security private notes + blog
After=network.target

[Service]
User=purenote
WorkingDirectory=/opt/pure-note
ExecStart=/opt/pure-note/pn start --addr 127.0.0.1:8080 \
          --data-dir /opt/pure-note/data --behind-proxy
Restart=on-failure
RestartSec=5

# 沙箱加固（§10.2）
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/pure-note/data
MemoryDenyWriteExecute=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictSUIDSGID=true

[Install]
WantedBy=multi-user.target