[Unit]
Description=Vibers preview gateway (serves the vibers' projects on 127.0.0.1:8090)
After=network-online.target

[Service]
Type=simple
User=vibers
Group=vibers
WorkingDirectory=/var/www/vibers
# Same hardening as PreviewService::ensureGateway(): no shell/network functions for generated code;
# the gateway also tightens open_basedir to each project's folder on every request.
ExecStart=/usr/bin/php \
  -d disable_functions=exec,shell_exec,system,passthru,proc_open,popen,proc_nice,proc_terminate,pcntl_exec,pcntl_fork,curl_exec,curl_multi_exec,fsockopen,pfsockopen,stream_socket_client,stream_socket_server,mail,putenv,dl,phpinfo,symlink,link,chown,chmod,chgrp,set_include_path,posix_kill,posix_setuid,show_source,highlight_file \
  -d allow_url_fopen=0 -d allow_url_include=0 -d expose_php=0 \
  -d memory_limit=128M -d max_execution_time=20 \
  -d upload_tmp_dir=/var/www/vibers/storage/temp/preview \
  -S 127.0.0.1:8090 -t /var/www/vibers/storage/projects /var/www/vibers/preview/gateway.php
Environment=PHP_CLI_SERVER_WORKERS=8
Environment="SF_FRAME_ANCESTORS='self' https://vibers.codes"
Restart=always
RestartSec=2
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ReadWritePaths=/var/www/vibers/storage

[Install]
WantedBy=multi-user.target