Running as a Service

[Unit]
Description=CertForge Certificate Governance Server
Documentation=https://docs.certgov.app
After=network-online.target
Wants=network-online.target
# Uncomment if using PostgreSQL:
# After=postgresql.service

[Service]
Type=simple
User=certforge
Group=certforge
WorkingDirectory=/opt/certforge

ExecStart=/usr/local/bin/certforge --config /etc/certforge/config.yaml
ExecReload=/bin/kill -HUP $MAINPID

Restart=on-failure
RestartSec=5s
TimeoutStartSec=30s
TimeoutStopSec=30s

# Security hardening
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/opt/certforge/data /var/log/certforge

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=certforge

# Environment (alternative to putting secrets in config.yaml)
# EnvironmentFile=/etc/certforge/environment

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable certforge
systemctl start certforge
systemctl status certforge

# Follow live
journalctl -u certforge -f

# Last 100 lines
journalctl -u certforge -n 100

# Since last boot
journalctl -u certforge -b

CERTFORGE_DB_URL=postgres://certforge:secret@localhost:5432/certforge?sslmode=require

chown root:certforge /etc/certforge/environment
chmod 640 /etc/certforge/environment

systemctl reload certforge

/var/log/certforge/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    postrotate
        systemctl reload certforge 2>/dev/null || true
    endscript
}

curl -sf http://localhost:8080/health && echo "OK" || echo "UNHEALTHY"