[Unit]
Description=Synchronise calendars with calcalist

[Service]
Type=oneshot
# The path the Nix install puts it at, which is also the one that guarantees a
# matching pimsync. A `cargo install` lands in %h/.cargo/bin instead; an
# absolute path is used either way because a user manager's PATH is not the
# login shell's and cannot be relied on to have found either.
ExecStart=%h/.nix-profile/bin/calcalist sync
NoNewPrivileges=true

# Deliberately no ProtectSystem, PrivateTmp or IPC sandboxing. Credentials come
# from commands like `secret-tool`, which need the session keyring over D-Bus,
# and those options break them in ways that surface as unexplained auth
# failures rather than as anything pointing at the sandbox.

# A cycle that could not reach an endpoint exits non-zero on purpose, so a
# lapsed token shows up as a failed unit rather than passing unnoticed.