From 4bf7ac2a15753661b84bb4b7b3fe850fd12d4ac9 Mon Sep 17 00:00:00 2001
From: jwinterm <johnwmurphy@gmail.com>
Date: Wed, 24 Dec 2025 12:38:16 -0500
Subject: [PATCH] docs: fix systemd paths to match /app clone location

- Update WorkingDirectory and EnvironmentFile paths
- Add instructions for creating .env before starting service
- Add systemctl enable/start commands
---
 README.md | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 5cfbb95..f954572 100644
--- a/README.md
+++ b/README.md
@@ -310,7 +310,7 @@ sudo chown -R wownerogue:wownerogue /var/www/wownerogue
 
 # Restrict permissions (owner only, no world access)
 sudo chmod 750 /var/www/wownerogue
-sudo chmod 640 /var/www/wownerogue/src/.env
+sudo chmod 640 /var/www/wownerogue/app/src/.env
 ```
 
 **Database permissions** - create a restricted PostgreSQL role:
@@ -342,6 +342,8 @@ sudo chmod 700 /home/*
 
 ### systemd Service
 
+Save to `/etc/systemd/system/wownerogue.service`:
+
 ```ini
 [Unit]
 Description=Wownerogue Game Server
@@ -351,8 +353,9 @@ After=network.target postgresql.service
 Type=simple
 User=wownerogue
 Group=wownerogue
-WorkingDirectory=/var/www/wownerogue/src
-EnvironmentFile=/var/www/wownerogue/src/.env
+# Adjust paths if you cloned to a different location
+WorkingDirectory=/var/www/wownerogue/app/src
+EnvironmentFile=/var/www/wownerogue/app/src/.env
 ExecStart=/usr/bin/node index.js
 Restart=on-failure
 RestartSec=10
@@ -368,6 +371,20 @@ ReadWritePaths=/var/www/wownerogue /var/log/wownerogue
 WantedBy=multi-user.target
 ```
 
+Then enable and start:
+
+```bash
+# Create .env from example first!
+sudo -u wownerogue cp /var/www/wownerogue/app/src/.env.example /var/www/wownerogue/app/src/.env
+sudo vim /var/www/wownerogue/app/src/.env  # Edit with your settings
+
+# Enable and start service
+sudo systemctl daemon-reload
+sudo systemctl enable wownerogue
+sudo systemctl start wownerogue
+sudo systemctl status wownerogue
+```
+
 The systemd hardening options:
 - `NoNewPrivileges` - prevents privilege escalation
 - `ProtectSystem=strict` - mounts filesystem read-only except allowed paths