[Unit]
Description=Velox download manager — RPC socket

[Socket]
# %t is $XDG_RUNTIME_DIR for a user unit — the exact path veloxd itself resolves
# (daemon/src/rpc/runtime_dir.cpp's resolve_runtime_dir), and the exact path velox(1)
# resolves too (default_socket_path() in cli/src/client.cpp). All three must agree; this
# is the one line that has to.
ListenStream=%t/velox/velox.sock

# RuntimeDirectory creates %t/velox (mode 0700, this user's own) before binding, so the
# ListenStream= path above always has somewhere to land — veloxd itself does the same
# thing (ensure_private_dir) when it creates the directory unassisted (the non-activated
# path, e.g. a manual `veloxd` run outside systemd).
RuntimeDirectory=velox
RuntimeDirectoryMode=0700

# Same-UID-only, matching the socket's own authorization once a connection is accepted
# (SO_PEERCRED, checked again in uds_server.cpp regardless of this mode bit — belt and
# braces, not a substitute for it).
SocketMode=0600

# The socket file belongs to systemd's socket-activation state, not to whatever's on disk
# from a previous boot; remove it on stop so a stale entry never shadows the next start.
RemoveOnStop=yes

[Install]
WantedBy=sockets.target