[Unit]
Description=Felhom host bootstrap (fetch + run felhom-host-install.sh unattended, retry until success)
Documentation=https://felhom.eu/documentation/backlog/ROADMAP.md
# Network-dependent work lives HERE (not in the first-boot stub) per spike S8a: the stub is
# exactly-once and network-independent; this unit retries forever until host-install exits 0.
After=network-online.target pve-cluster.service pveproxy.service
Wants=network-online.target
# Second exactly-once lock (the script also writes/checks this flag): once host-install succeeds,
# the flag exists and this unit becomes a no-op even if re-enabled.
ConditionPathExists=!/etc/felhom/.bootstrap-done
# Retry forever: no start-rate limit.
StartLimitIntervalSec=0

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/felhom-bootstrap.sh
# v1.21.0 (R-33): the PAIRING wait now loops INSIDE the script, so this unit sits in `activating`
# while a box waits to be bound instead of failing every 30s. That wait is unbounded by nature —
# it ends when a human binds the box — so the oneshot start timeout MUST be lifted. Without this,
# systemd kills ExecStart at DefaultTimeoutStartSec (90s) and Restart= silently reinstates exactly
# the `Failed to start` console spam this change exists to remove.
TimeoutStartSec=infinity
# Still retry on a genuine non-zero exit (fetch failed, host-install failed mid-run, crash-window
# 410). The pairing wait no longer exits non-zero just because nobody has bound the box yet.
Restart=on-failure
RestartSec=30
# Journal-only logging (no secret ever printed; keys-not-values).
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target