[Unit]
Description=Synchronise calendars with calcalist

[Service]
Type=oneshot
ExecStart=%h/.local/bin/calcalist sync
NoNewPrivileges=true

# Deliberately no ProtectSystem, PrivateTmp or IPC sandboxing. Credentials come
# from commands like `secret-tool`, which need the session keyring over D-Bus,
# and those options break them in ways that surface as unexplained auth
# failures rather than as anything pointing at the sandbox.

# A cycle that could not reach an endpoint exits non-zero on purpose, so a
# lapsed token shows up as a failed unit rather than passing unnoticed.