[Unit]
Description=drift WOPI Bridge (Collabora ↔ CommuniGate Pro)
Documentation=https://drift.email/#wopi-bridge
After=network.target CommuniGate.service
Wants=network.target

[Service]
Type=simple
User=drift-wopi
Group=drift-wopi
ExecStart=/usr/local/bin/wopi-bridge
Restart=always
RestartSec=5
# CGP HTTP endpoint the bridge talks to (defaults to 127.0.0.1:8100).
# Uncomment + adjust if CGP runs on a different host or port.
# Environment=CGP_HOST=127.0.0.1
# Environment=CGP_PORT=8100
StandardOutput=append:/var/log/drift-wopi-bridge.log
StandardError=append:/var/log/drift-wopi-bridge.log

# Sandboxing — the bridge only needs outbound HTTP to CGP + inbound on 8200.
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true

[Install]
WantedBy=multi-user.target