# Versioned in felhom.eu/scripts/dooplex-offsite/ (R-232); installed by install.sh. Plan: audits/dooplex-survival-2026-10-09/PLAN.md.
[Unit]
Description=Felhom: push Gitea + DooPlex secrets to ep0, encrypted (R-232)
Wants=network-online.target felhom-ep0-pbs-tunnel.service
After=network-online.target felhom-ep0-pbs-tunnel.service
OnFailure=felhom-backup-failmail@%n.service

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/felhom-dooplex-offsite
Environment=HOME=/var/lib/felhom-dooplex-offsite KUBECONFIG=/etc/rancher/k3s/k3s.yaml
UMask=0077
TimeoutStartSec=90min
Nice=10
IOSchedulingClass=idle
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/felhom-dooplex-offsite /var/lib/node_exporter/textfile_collector
NoNewPrivileges=yes