vextoly/gitman

# Install as /etc/systemd/system/gitman.service.d/zz-private-socket.conf.
# Sort after rollback-data.conf so its old TCP ExecStart cannot override this.
[Unit]
Requires=gitman.socket
After=gitman.socket

[Service]
Type=notify
NotifyAccess=main
TimeoutStartSec=60
ExecStart=
ExecStart=/opt/apps/gitman/.venv/bin/gunicorn --bind unix:/run/gitman/gunicorn.sock --workers 2 --worker-class gthread --threads 4 app:app
# Defense in depth: Gunicorn may inherit the Unix socket, but cannot bind TCP/UDP.
SocketBindDeny=any