[Unit]
Description=TANINUX [tanin] repo — daily AUR rebuild
Documentation=file:%h/taninux/packaging/aur-autoupdate.sh
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
# Dedicated, locked build account (see setup-build-user.sh) — NOT the human
# "karim" account. Isolates the root-equivalent makechrootpkg/arch-nspawn/
# mkarchroot sudo grant (tanin-aur-update.sudoers) off the personal login.
User=tanin-build
Group=tanin-build
# %h now resolves against tanin-build's home (/var/lib/tanin-build by
# setup-build-user.sh), NOT /home/karim — so this checkout must live there
# too (setup-build-user.sh clones/syncs it in). Adjust if it lives elsewhere.
ExecStart=%h/taninux/packaging/aur-autoupdate.sh run
# The packager signing key: GPGKEY must be set, and GNUPGHOME (default
# %h/.gnupg = /var/lib/tanin-build/.gnupg) must actually contain that secret
# key for tanin-build — see gen-signing-key.sh + setup-build-user.sh.
# Environment=GPGKEY=<packager key fingerprint, from gen-signing-key.sh>
# Environment=GNUPGHOME=%h/.gnupg   # only needed if it's not already the default
# Be a good citizen — this is a background rebuild, not interactive work.
Nice=15
IOSchedulingClass=idle
# Uncomment + set once hosting is wired, e.g.:
# Environment=TANIN_PUBLISH_CMD=rsync -a --delete %h/projects/tanin-repo/ host:/srv/tanin/

[Install]
WantedBy=default.target