[Unit]
Description=Rotate the demo-app AppRole SecretID before its 30d TTL expires
After=network-online.target docker.service
Wants=network-online.target
Requires=docker.service
OnFailure=openbao-alert@%n.service

[Service]
Type=oneshot
# Runs as root: reads /etc/openbao-approle-rotate.token and writes the
# SecretID back as lutz:lutz 0600.
ExecStart=/home/lutz/Projects/OpenBAO/scripts/rotate-approle-secret-id.sh