[Unit]
Description=SEO Insight — GSC sync (Rust; one-shot, run by seo-insight-gsc-worker.timer)
After=network.target postgresql.service seo-insight-web.service
Wants=postgresql.service

[Service]
# One-shot: the worker does a single Search Console pull (all mapped sites) and
# exits. It is triggered periodically by seo-insight-gsc-worker.timer — NOT a
# long-running daemon, so there is no Restart= here and no [Install] (the timer
# owns scheduling; enabling the .service directly would just run it once at boot).
Type=oneshot
User=seoinsight
Group=seoinsight
WorkingDirectory=/opt/seo-insight
EnvironmentFile=/opt/seo-insight/.env.production
# The worker calls the web app's token-broker route internally (no TLS needed).
Environment=APP_URL=http://127.0.0.1:3000
# Optional: how many days of GSC history to pull per run (worker default = 5).
# Environment=GSC_WINDOW_DAYS=5
ExecStart=/opt/seo-insight/target/release/gsc-worker
NoNewPrivileges=true
ProtectSystem=full
PrivateTmp=true