# Retry shape for a oneshot that fetches a credential or certificate from
# the secret store: every 30s for 24h. Under `seal = "shamir"` an operator
# unseals BY HAND, and a fetch fails for as long as that takes, or for as
# long as the store or the gateway in front of it is down. `start-limit-hit`
# does not clear when the store comes back, so a budget shorter than the
# outage leaves the unit failed until something starts it again.
#
# `StartLimit*` are `[Unit]` settings — systemd ignores them under
# `[Service]` — and the window must exceed `RestartSec × burst` or it closes
# between attempts and the burst is never reached: 2880 × 30s is 24h inside
# a 25h window.
#
# ⚠️ A unit in auto-restart is still `activating`, so its start job stays
# queued across attempts: anything ordered `After=` it waits for as long as
# it retries, up to the full 24h.
#
# Pure attrset — NOT a NixOS module. Use from a unit definition:
#
#   storeRetry = import ./lib/store-retry.nix { };
#   systemd.services.foo = {
#     inherit (storeRetry) startLimitBurst startLimitIntervalSec;
#     serviceConfig = storeRetry.serviceConfig // { Type = "oneshot"; };
#   };
{ }:
{
  startLimitBurst = 2880;
  startLimitIntervalSec = 90000;
  serviceConfig = {
    Restart = "on-failure";
    RestartSec = 30;
  };
}