# Watch usbguard for refused devices, so a person is told rather than left
# holding something that does not work.
#
# The reasoning is in usr/bin/alloy-usb-notify; this file is only what keeps it
# listening. `usbguard watch` is a long-lived IPC client that runs the program
# once per event, which is why this is a service rather than something the
# console starts.
#
# ## Why it is not tied to usbguard.service the obvious ways
#
# BindsTo= and Requires= both PULL THE DAEMON IN, and this must never be a
# reason for enforcement to start. Same rule as the seeder and the gate: the
# only thing allowed to arm this machine is the preset line and a person.
#
# Requisite= would avoid that but fails the unit when the daemon is not running,
# which on a machine with no policy is the normal state and would leave a failed
# unit sitting in `systemctl --failed` saying nothing useful. So the condition is
# the same one usbguard itself carries: no policy, no enforcement, nothing to
# watch, and both units are skipped quietly for the same reason on the same
# machines.
#
# ## Why it survives the daemon going away
#
# The keyboard gate stops usbguard whenever the machine loses its keyboard, and
# starts it again when one comes back. A watcher that exited on disconnect would
# be gone for good after the first such episode, on exactly the machine that has
# already had one problem. `usbguard watch --wait` reconnects rather than
# exiting. `--once` is the flag that would make it exit, and it is deliberately
# not passed. Restart=always covers the rest.
#
# Measured: with the daemon stopped and started underneath it, the watcher stays
# up and keeps delivering.

[Unit]
Description=Tell someone when a USB device is refused
Documentation=https://makenot.work/git/max/alloy
After=usbguard.service
ConditionPathExists=/usr/bin/usbguard
# The same condition usbguard.service carries. A machine with no policy is not
# enforcing, so there is nothing to report and this is skipped rather than
# failed. See etc/systemd/system/usbguard.service.d/.
ConditionFileNotEmpty=/etc/usbguard/rules.conf

[Service]
Type=simple
ExecStart=/usr/bin/usbguard watch --wait --exec /usr/bin/alloy-usb-notify
Restart=always
RestartSec=2

[Install]
WantedBy=multi-user.target