check new version

roles/03-installation-minecraft/templates/minecraft.service.j2

@@ -1,18 +1,54 @@
+# {{ ansible_managed }}
 [Unit]
-Description=Minecraft Spigot Server
-After=network.target
+Description=Minecraft Server (Spigot {{ minecraft_version }})
+After=network-online.target
+Wants=network-online.target
 
 [Service]
-Type=forking
+Type=simple
 User={{ minecraft_user }}
 Group={{ minecraft_group }}
 WorkingDirectory={{ minecraft_server_dir }}
-ExecStart=/usr/bin/java -Xms{{ minecraft_memory_min }} -Xmx{{ minecraft_memory_max }} -jar spigot.jar nogui
-ExecStop=/usr/local/bin/mcrcon -H 127.0.0.1 -P {{ rcon_port }} -p {{ rcon_password }} stop
-TimeoutStartSec=600
-TimeoutStopSec=600
+
+# Start command with optimized JVM flags
+ExecStart=/usr/bin/java \
+    -Xms{{ minecraft_memory_min }}M \
+    -Xmx{{ minecraft_memory_max }}M \
+    {{ jvm_flags }} \
+    -jar {{ spigot_jar_name }} \
+    --nogui
+
+# Stop command using mcrcon
+ExecStop={{ minecraft_tools_dir }}/mcrcon -H localhost -P {{ rcon_port }} -p "{{ rcon_password }}" stop
+
+# Restart settings
 Restart=on-failure
-RestartSec=20
+RestartSec=10
+StartLimitInterval=600
+StartLimitBurst=3
+
+# Security settings
+PrivateTmp=yes
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths={{ minecraft_base_dir }}
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+LockPersonality=true
+
+# Resource limits
+LimitNOFILE=100000
+LimitNPROC=512
+
+# Logging
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=minecraft
 
 [Install]
 WantedBy=multi-user.target