kevinveenbirkenbachandClaude Opus 5 18aaf57006 test(lint): let sys-service own every systemd unit a role installs ...

sys-service resolves the template, writes it into the unit directory, reloads the daemon, enables and starts the unit, and carries the timer, async and flush behaviour. A role that renders its own service.j2 with a bare template task gets the file and none of the rest, and every one of those omissions is silent: a unit that exists but was never enabled looks installed until the host reboots.

The lint reports any src pointing at a service.j2 inside a role's tasks. desk-ssh was the one finding left after sys-svc-firewall moved over, and it migrates here: its ssh-agent unit now comes from sys-service in the user scope, with the type, ordering, environment and Install section supplied as template fields. RuntimeMaxSec is pinned empty on purpose, because the default applies it to anything that is not oneshot and would kill a long-running agent after a day.

The unversioned unit is retired first. sys-service names units by version, so the old file would otherwise stay behind enabled and a second agent would bind the same socket.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-15 20:34:33 +02:00

..

00_core.yml

test(lint): let sys-service own every systemd unit a role installs

2026-09-15 20:34:33 +02:00

main.yml

refactor(tasks): enforce and apply a single task-file numbering scheme

2026-07-23 20:01:31 +02:00