[Unit]
Description=Weekly rotation of the demo-app AppRole SecretID

[Timer]
# Weekly against a 30d secret_id_ttl: 4x margin, so three consecutive failed
# rotations can happen before the credential actually expires -- and the first
# failure already mails an alert via OnFailure=.
OnCalendar=Sun *-*-* 03:10:00
Persistent=true
RandomizedDelaySec=15m

[Install]
WantedBy=timers.target