[Unit]
Description=vela PocketBase %i
Documentation=https://velastack.dev/docs
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=vela
Group=vela
WorkingDirectory=/var/lib/vela/apps/%i

# Three layers, each secret and public, then what vela derives. Later wins.
# The scope.* names are symlinks apply.sh writes into the app-wide and preview
# layers under /etc/vela/scopes; a layer that does not exist is skipped.
EnvironmentFile=-/etc/vela/apps/%i/scope.all.env
EnvironmentFile=-/etc/vela/apps/%i/scope.all.public.env
EnvironmentFile=-/etc/vela/apps/%i/scope.preview.env
EnvironmentFile=-/etc/vela/apps/%i/scope.preview.public.env
EnvironmentFile=-/etc/vela/apps/%i/env
EnvironmentFile=-/etc/vela/apps/%i/env.public
EnvironmentFile=/etc/vela/apps/%i/runtime.env

ExecStart=/var/lib/vela/apps/%i/bin/pocketbase \
	--dir /var/lib/vela/apps/%i/shared/pb_data \
	--migrationsDir /var/lib/vela/apps/%i/current/migrations \
	--hooksDir /var/lib/vela/apps/%i/current/hooks \
	serve --http=127.0.0.1:${PB_PORT}

Restart=on-failure
RestartSec=2
TimeoutStartSec=60
TimeoutStopSec=30
KillSignal=SIGINT

StandardOutput=journal
StandardError=journal
SyslogIdentifier=vela-pb-%i

LimitNOFILE=65535

NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/vela/apps/%i

[Install]
WantedBy=multi-user.target