# Clusev update-sentinel — service unit (HOST-side).
#
# Triggered by clusev-update.path. Runs watch.sh update: consumes the sentinel, then runs
# update.sh (git pull --ff-only + the idempotent install.sh). A oneshot — it exits when done
# and the .path unit re-arms for the next request.
#
# SECURITY: like the restart unit, this is host-side; the panel container has NO Docker socket
# and only writes the sentinel file. This service runs as ROOT (not the `clusev` user the
# restart unit uses) because update.sh -> install.sh needs root for docker/systemd/apt. It only
# ever runs the project's own committed update.sh, pulling from the configured (trusted) remote.
#
# install.sh rewrites WorkingDirectory= / ExecStart= / Environment=CLUSEV_DIR to the real path.
[Unit]
Description=Clusev update sentinel — pull + re-install the stack on request
After=docker.service
Requires=docker.service

[Service]
Type=oneshot
User=root
# HOME is needed so update.sh's `git config --global --add safe.directory` lands in root's
# config and the subsequent root-run `git pull` is allowed on the clusev-owned tree.
Environment=HOME=/root
Environment=CLUSEV_DIR=/home/nexxo/clusev
WorkingDirectory=/home/nexxo/clusev
ExecStart=/home/nexxo/clusev/docker/restart-sentinel/watch.sh update
# A full update (pull + image rebuild + migrate) takes longer than a restart.
TimeoutStartSec=900