[Unit]
Description=Renew scoped OpenBAO app tokens so periodic tokens never lapse
After=network-online.target docker.service
Wants=network-online.target
Requires=docker.service

[Service]
Type=oneshot
# Runs as root: must read the root-owned /etc/openbao-*.token infra tokens
# (backup x2, cert-renew) alongside the user-owned ~lutz/.config/openbao ones.
ExecStart=/home/lutz/Projects/OpenBAO/scripts/renew-app-tokens.sh
# Renews both sets via auth/token/renew-self. Best-effort.