[Unit]
Description=Velox download manager daemon
Documentation=man:velox(1)
# Socket activation (velox.socket) means this unit does not need to be enabled or started
# directly for the RPC transport to come up on demand — the first connection attempt after
# boot starts veloxd with the listening socket already bound (see velox.socket's own
# comment). Requires=/After= still matter for a manual `systemctl --user start velox`.
Requires=velox.socket
After=velox.socket

# Never more than one real instance for this user regardless of how it was started — the
# abstract-socket single-instance lock (main.cpp, keyed off the resolved runtime dir) is
# the actual enforcement; this just keeps systemd itself from racing two starts.
StartLimitIntervalSec=60
StartLimitBurst=5

[Service]
Type=simple
ExecStart=/usr/bin/veloxd
# main.cpp's SIGTERM handler stops the event loop and falls through to a clean shutdown
# (flushes buffers, closes the store, releases the single-instance lock) — the default
# KillSignal=SIGTERM and TimeoutStopSec are already the right shape for that; no
# ExecStop/KillMode override needed.
Restart=on-failure
RestartSec=2

# Hardening deliberately stops here, not at ProtectSystem=/ProtectHome=/ReadWritePaths=:
# saveTo.allowedRoots is user-configurable to anywhere (an external drive, a second
# mount — fs/safepath.hpp is the daemon's own validation boundary, not a fixed set of
# directories a unit file could enumerate up front). A filesystem-level sandbox here would
# silently turn a legitimately-configured save location into an opaque EROFS/EACCES the
# daemon can't explain, instead of its own clear -32011 — worse than no sandbox, for a
# download manager specifically. NoNewPrivileges is free of that trade-off.
NoNewPrivileges=yes

[Install]
WantedBy=default.target
Also=velox.socket