# systemd installation

1. Install the application files under `/opt/rustpad` and the binary as `/usr/local/bin/rustpad`.
2. Create the service account: `useradd --system --home /var/lib/rustpad --shell /usr/sbin/nologin rustpad`.
3. Copy `rustpad.yaml` to `/etc/rustpad/rustpad.yaml` and restrict secrets: `chmod 640 /etc/rustpad/rustpad.yaml`.
4. Copy `rustpad.service` to `/etc/systemd/system/rustpad.service`.
5. Validate before starting: `/usr/local/bin/rustpad --config /etc/rustpad/rustpad.yaml check-config`.
6. Run `systemctl daemon-reload && systemctl enable --now rustpad`.

Environment variables and an optional `.env` file override the YAML values. This allows secrets to be supplied by the service manager without editing the main configuration file.

To serve attachments from a separate domain, set `files_public_url` in `rustpad.yaml`.
The attachment-only listener uses `files_port: 3001` by default (same `app.host`).
Point the file subdomain's reverse proxy at that port; no path-based access
restrictions are needed. `/health` (and `/healthz`) returns `ok` on the file listener
for health monitoring. Without `files_public_url`, files use `app.port` and
no separate listener starts.