[Unit]
Description=vela app %i
Documentation=https://velastack.dev/docs
After=network-online.target vela-pb@%i.service
Wants=network-online.target

[Service]
Type=simple
User=vela
Group=vela
WorkingDirectory=/var/lib/vela/apps/%i/current

# Production secrets first, vela-generated runtime settings second, so PORT and
# POCKETBASE_URL always match what the server actually assigned.
# Three layers, each secret and public, then what vela derives. Later wins.
# The scope.* names are symlinks apply.sh writes into the app-wide and preview
# layers under /etc/vela/scopes; a layer that does not exist is skipped.
EnvironmentFile=-/etc/vela/apps/%i/scope.all.env
EnvironmentFile=-/etc/vela/apps/%i/scope.all.public.env
EnvironmentFile=-/etc/vela/apps/%i/scope.preview.env
EnvironmentFile=-/etc/vela/apps/%i/scope.preview.public.env
EnvironmentFile=-/etc/vela/apps/%i/env
EnvironmentFile=-/etc/vela/apps/%i/env.public
EnvironmentFile=/etc/vela/apps/%i/runtime.env

ExecStart=/usr/bin/node /var/lib/vela/apps/%i/current/build/index.js

Restart=on-failure
RestartSec=2
TimeoutStartSec=60
TimeoutStopSec=30
KillSignal=SIGINT

StandardOutput=journal
StandardError=journal
SyslogIdentifier=vela-web-%i

LimitNOFILE=65535

NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/vela/apps/%i

[Install]
WantedBy=multi-user.target