# {{ ansible_managed }}
[Unit]
Description=Obsidian Headless Sync ({{ obsidian_headless_vault_path }})
Documentation=https://obsidian.md/help/sync/headless
Wants=network-online.target
After=network-online.target
# Inert until `ob login` and `ob sync-setup` have been run by hand.
ConditionPathExists={{ obsidian_headless_home }}/.config/obsidian-headless/auth_token
ConditionDirectoryNotEmpty={{ obsidian_headless_home }}/.config/obsidian-headless/sync

[Service]
Type=simple
User={{ obsidian_headless_user }}
Group={{ obsidian_headless_group }}
# Everything Sync creates is private unless it lands under a folder with a
# default ACL (the shared folders), where the umask does not apply.
UMask=0077
Environment=HOME={{ obsidian_headless_home }}
Environment=PATH={{ obsidian_headless_node_bin_dir }}:/usr/bin:/bin
WorkingDirectory={{ obsidian_headless_vault_path }}
ExecStart={{ obsidian_headless_link_dir }}/ob sync --continuous --path {{ obsidian_headless_vault_path }}
Restart=on-failure
RestartSec=30
# 2: missing encryption key, 3: no sync configuration. Both need a human.
RestartPreventExitStatus=2 3

NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths={{ obsidian_headless_vault_path }} {{ obsidian_headless_home }}

[Install]
WantedBy=multi-user.target