# Read the bank and hand the incoming credits to the server.
#
# A USER unit, on the machine whose IP the bunq API key permits — NOT on the
# web host. The web host cannot call bunq at all (the key is IP-restricted at
# the key level and bunq enforces it on every request), and it should not be
# able to: a bunq key can initiate payments, because bunq offers no read-only
# scope. So the key stays here and the server only ever reads a file.
#
# Install:
#   mkdir -p ~/.config/systemd/user
#   cp deploy/catcrafts-credits.{service,timer} ~/.config/systemd/user/
#   systemctl --user daemon-reload
#   systemctl --user enable --now catcrafts-credits.timer
#   loginctl enable-linger "$USER"      # so it runs when nobody is logged in
#
# Watch:  journalctl --user -u catcrafts-credits -f
[Unit]
Description=Pull bunq credits and ship them to catcrafts.net
Documentation=file:deploy/README.md
# Pointless without a route to the bank or to the server.
After=network-online.target

[Service]
Type=oneshot
WorkingDirectory=%h/repos/catcrafts.net
ExecStart=%h/repos/catcrafts.net/tools/pull-and-ship-credits.sh
# A failed pull must not look like a successful one. The script already refuses
# to overwrite the remote with an empty file, so a failure here leaves the
# server settling from the last good copy rather than from nothing.
SuccessExitStatus=0