## tunnel unit
[Unit]
Description=Felhom: SSH tunnel DooPlex 127.0.0.1:18007 -> ep0 PBS 127.0.0.1:8007 (decision 70, nightly pull-sync of felhom-offsite)
Documentation=file:///mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/runbooks/ep0-datastore-copy.md
After=network-online.target
Wants=network-online.target

[Service]
User=kisfenyo
ExecStart=/usr/bin/ssh -N -o BatchMode=yes -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=3 -L 127.0.0.1:18007:127.0.0.1:8007 root@167.233.158.164
Restart=always
RestartSec=30

[Install]
WantedBy=multi-user.target
active

## notification target + matcher (password lives in notifications-priv.cfg, root:root 0600, not shown)
smtp: felhom-operator
	author Felhom DooPlex PBS
	comment decision 70: ep0 copy job failures to the operator (Resend)
	from-address monitoring@felhom.eu
	mailto admin@felhom.eu
	mode tls
	port 465
	server smtp.resend.com
	username resend

matcher: felhom-operator-errors
	comment decision 70: any error (the ep0 pull-sync and verify jobs) reaches the operator
	match-severity error
	mode all
	target felhom-operator

## test mail: received in the operator mailbox 2026-10-03T19:17:41Z, subject 'Test notification', from monitoring@felhom.eu to admin@felhom.eu (Gmail connector search)

## ep0 side: token root@pam!dooplex-sync, ACL DatastoreReader on /datastore/felhom-offsite (propagate) — the only change on ep0