# Timer for a host oneshot that fetches a credential from the swarm secret
# store: it starts the oneshot again 10 minutes after each run, so a value
# re-minted in the store lands on the host and restarts its consumer with no
# operator step. Ten minutes matches the agent's own store re-read
# (../../agent-modules/bao.nix).
#
# ⚠️ The oneshot must not be `RemainAfterExit`: starting a unit that stays
# `active (exited)` is a no-op, so the timer would fire and fetch nothing.
# A run that reads an unchanged value writes nothing and restarts nothing —
# its `secret_differs` gate and ./refresh-consumer.nix see to that.
#
# Gate the timer exactly as its service is gated: a timer whose unit does
# not exist fails to load.
#
# Pure function — NOT a NixOS module. Call it from a module's `let`:
#
#   storeRefreshTimer = import ./lib/store-refresh-timer.nix { };
#   systemd.timers.swarm-bao-foo = storeRefreshTimer "re-read foo's secret from the swarm secret store";
{ }:
description: {
  inherit description;
  wantedBy = [ "timers.target" ];
  timerConfig = {
    OnUnitInactiveSec = "10min";
    RandomizedDelaySec = "1min";
  };
}