chore: add example systemd service unit file [ci skip]

etc/Caddyfile

@@ -0,0 +1,26 @@
+wakapi.yourdomain.tld {
+    encode zstd gzip
+
+    header {
+        Strict-Transport-Security "max-age=2592000; includeSubDomains"
+    }
+	
+    log {
+        output file /var/log/caddy/wakapi.dev.access.log
+        format single_field common_log
+    }
+
+    reverse_proxy http://[::1]:3000
+
+    @api path_regexp "^/api.*"
+    @notapi not path_regexp "^/api.*"
+
+    push @notapi /assets/vendor/source-sans-3.css
+    push @notapi /assets/css/app.dist.css
+    push @notapi /assets/vendor/petite-vue.min.js
+    push @notapi /assets/vendor/chart.min.js
+    push @notapi /assets/vendor/iconify.basic.min.js
+    push @notapi /assets/js/icons.dist.js
+    push @notapi /assets/js/base.js
+    push @notapi /assets/images/logo.svg
+}

etc/wakapi.service

@@ -0,0 +1,53 @@
+[Unit]
+Description=Wakapi
+StartLimitIntervalSec=400
+StartLimitBurst=3
+
+# Optional, in case you're running MySQL / Postgres with Systemd, too
+Requires=mysql.service
+After=mysql.service
+
+[Service]
+Type=simple
+
+# Assuming Wakapi executable is under /opt/wakapi and config file at /etc
+# Feel free to change this
+WorkingDirectory=/opt/wakapi
+ExecStart=/opt/wakapi/wakapi -config /etc/wakapi.yml
+
+# Environment variables, see README for more
+Environment=WAKAPI_DB_HOST=localhost
+Environment=WAKAPI_DB_USER=wakapi
+Environment=WAKAPI_DB_NAME=wakapi
+Environment=WAKAPI_DB_PASSWORD=secretpassword
+Environment=WAKAPI_PASSWORD_SALT=somerandomstring
+
+# TODO: Use Systemd's credentials management (https://systemd.io/CREDENTIALS/) introduced in v247 (%d syntax in v250) once more established
+
+# sudo groupadd wakapi
+# sudo useradd -g wakapi wakapi
+User=wakapi
+Group=wakapi
+
+Restart=on-failure
+RestartSec=90
+
+# Security hardening
+PrivateTmp=true
+PrivateUsers=true
+NoNewPrivileges=true
+ProtectSystem=full
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+PrivateDevices=true
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+ProtectClock=true
+RestrictSUIDSGID=true
+ProtectHostname=true
+ProtectProc=invisible
+
+[Install]
+WantedBy=multi-user.target