[Unit]
Description=Renew the fleet SSH host certificate
Documentation=https://git.bitasylum.org/audiobuzz/diskless-workstation/docs/ssh-host-certificate-design.md

[Timer]
# Fire shortly after boot (once the network + enrolment are likely ready) to
# acquire the first cert for this boot's ephemeral host key, then renew well
# inside the cert's validity window. The service is idempotent + fail-open, so a
# missed/failed run just retries next cycle (sshd keeps serving the bare key
# meanwhile). Cadence is bench-tunable (host-cert validity is a step-ca policy).
OnBootSec=60s
OnUnitActiveSec=1h
Persistent=false
AccuracySec=15s

[Install]
WantedBy=timers.target