chore: makefile + setup

deploy/osiris.service.template

@@ -0,0 +1,28 @@
+[Unit]
+Description=Osiris — cat medication and pulse tracking
+After=network.target
+
+[Service]
+Type=notify
+User=__USER__
+WorkingDirectory=__PROJECT_DIR__
+EnvironmentFile=__PROJECT_DIR__/.env
+# --no-sync: 'make install' already synced. Without it, uv would try to resolve
+# dependencies at boot, which needs the network and can fail at the worst moment.
+ExecStart=__UV__ run --no-sync gunicorn osiris.wsgi:application \
+    --bind 127.0.0.1:__PORT__ \
+    --workers 2 \
+    --access-logfile - \
+    --error-logfile -
+Restart=on-failure
+RestartSec=5s
+
+# SQLite and the media/static dirs are the only things it needs to write.
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+ProtectHome=read-only
+ReadWritePaths=__PROJECT_DIR__
+
+[Install]
+WantedBy=multi-user.target