# Reference copy of the systemd unit. The LIVE unit lives at
# /etc/systemd/system/rosters.service on the droplet (systemd units are not
# deployed by the git webhook — install this on the server by hand, then
# `systemctl daemon-reload && systemctl enable --now rosters.service`).
#
# Conventions per docs/WHEN CREATING A NEW APP.md §5:
#   - bind 127.0.0.1 (no host firewall; a 0.0.0.0 bind would be internet-exposed)
#   - EnvironmentFile=/root/secrets.env — provides ROSTERS_PASSWORD_HASH (the
#     admin panel's own bcrypt password; the service REFUSES to start if unset)
#   - Restart=on-failure + StartLimitBurst=3 (NEVER Restart=always on app code)

[Unit]
Description=Rosters — AHA class roster + public student self-signup (port 3017)
After=network.target

[Service]
Type=simple
User=root
WorkingDirectory=/var/www/adampowell.pro/apps/server/rosters
EnvironmentFile=/root/secrets.env
Environment=NODE_ENV=production
Environment=PORT=3017
ExecStart=/usr/bin/node /var/www/adampowell.pro/apps/server/rosters/server.js
Restart=on-failure
RestartSec=10
StartLimitIntervalSec=60
StartLimitBurst=3
StandardOutput=append:/var/log/rosters-app.log
StandardError=append:/var/log/rosters-error.log

[Install]
WantedBy=multi-user.target