[Unit]
Description=Voicemail portal (transcripts, playback, per-mailbox settings)
Documentation=file:/opt/vm-transcribe/vm_web.py
After=network.target
Wants=network.target

[Service]
Type=simple
# Runs as asterisk so it can read voicemail.conf and the spool.
User=asterisk
Group=asterisk
WorkingDirectory=/opt/vm-transcribe

Environment=VM_DB=/var/lib/vm-transcribe/voicemail.db
Environment=VM_AUDIO_DIR=/var/lib/vm-transcribe/audio
Environment=VM_ASTERISK_CONF=/etc/asterisk/voicemail.conf
Environment=VM_SESSION_HOURS=12
Environment=PYTHONUNBUFFERED=1

ExecStart=/opt/vm-transcribe/venv/bin/python -m uvicorn vm_web:app \
    --host 127.0.0.1 --port 8099 \
    --proxy-headers --forwarded-allow-ips 127.0.0.1 \
    --log-level info

Restart=on-failure
RestartSec=3

# --- hardening ---------------------------------------------------------
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ProtectHome=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
# Only these paths need to be writable.
ReadWritePaths=/var/lib/vm-transcribe /var/log/asterisk
# Loopback only; Apache is the only client.
IPAddressAllow=localhost
IPAddressDeny=any

[Install]
WantedBy=multi-user.target