[Unit]
Description=Archipelago host-secret audit (are this node's SSH/TLS keys per-node?)
Documentation=file:///opt/archipelago/scripts/security/host-secrets-audit.sh
# Ordered after first-boot regeneration so a fresh node is judged on the keys
# it ends up with, not the ones it booted with. network.target because the
# fingerprints are only meaningful once the node has an identity to report as.
After=archipelago-first-boot-secrets.service network.target
ConditionPathExists=/opt/archipelago/scripts/security/host-secrets-audit.sh

[Service]
Type=oneshot
# Reads /etc/ssh and /etc/archipelago/ssl and writes
# /var/lib/archipelago/host-secrets-audit.json, all of which are root-owned.
User=root
# DETECT ONLY. D-06 chose detect-report-then-apply
# (docs/security/KEY-02-FLEET-ROTATION.md): rotation is one-way and must never
# fire unattended across the fleet during an OTA. There is deliberately NO
# --apply here. Adding one is a decision, not a configuration change.
ExecStart=-/opt/archipelago/scripts/security/host-secrets-audit.sh --detect
# The leading `-` above: a failed audit must never fail a boot. The verdict is
# informational; a node that cannot be judged is still a node that must come up.
TimeoutStartSec=60
RemainAfterExit=yes
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target