[Unit]
Description=Ship an encrypted OpenBAO DR bundle to the NAS (fids2)
After=network-online.target home-lutz-nfs_projects.automount
Wants=network-online.target
OnFailure=openbao-alert@%n.service

[Service]
Type=oneshot
# Runs as root: reads /var/backups/openbao (0700 root) and the 0600 unseal
# material. Encrypts to HOME_SECURE before anything touches the share.
ExecStart=/home/lutz/Projects/OpenBAO/scripts/offsite-backup.sh