# Write this machine's USB policy before anything enforces one.
#
# The reasoning is all in usr/bin/alloy-usb-seed; this file is only what runs
# it. The short version: the image ships an empty rules.conf on purpose, and
# an empty policy plus ImplicitPolicyTarget=block is "deny every USB device on
# this machine". The seeder turns that into "allow what this machine already
# had", which is the only policy the machine itself can honestly assert.
#
# Ordering is the whole point of the unit. Before=usbguard.service, so the
# daemon never sees the empty file; After=systemd-udevd.service, so the bus has
# been enumerated and generate-policy has something to read. Without the second
# the policy would be written from a half-populated /sys and would deny whatever
# had not appeared yet.
#
# Not Wants=usbguard.service, and never Requires=. This must not be a reason for
# enforcement to start; it prepares the ground for a daemon that is armed
# somewhere else, and on the majority of machines — usbguard installed and not
# enabled — it writes a policy nothing reads. That is deliberate: it means the
# day a person arms enforcement from `alloy usb`, the policy is already there.
#
# The seeder is idempotent against a written policy, so this is enabled on every
# install rather than gated on a stamp. See the script for why the policy file
# itself is the state.

[Unit]
Description=Seed the USB device policy from this machine's own devices
Documentation=https://makenot.work/git/max/alloy
After=systemd-udevd.service
Wants=systemd-udevd.service
Before=usbguard.service
# On a machine with no usbguard the script exits saying so, which is harmless
# and pointless. The condition says it out loud instead.
ConditionPathExists=/usr/bin/usbguard

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/alloy-usb-seed
# The script returns 0 on every path it means to take, including the ones where
# it decides not to write anything, so a non-zero here is a real fault. It must
# not be fatal to the boot: a seeder that failed leaves the policy empty, and an
# empty policy is refused by usbguard's own drop-in rather than enforced.

[Install]
WantedBy=multi-user.target