# Multi-site active failover pilot (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md). Install on the
# VPS (172.93.53.139) alongside ha-failover-watcher.sh:
#   scp scripts/ha-failover-watcher.sh root@172.93.53.139:/usr/local/bin/
#   ssh root@172.93.53.139 chmod +x /usr/local/bin/ha-failover-watcher.sh
#   mkdir -p /etc/ha-failover on the VPS, put the Cloudflare DNS-edit
#     token (same one cert-manager's cloudflare-token-secret uses) in
#     /etc/ha-failover/cloudflare-token, chmod 600, chown root
#   scp this file to /etc/systemd/system/ha-failover-watcher.service
#   systemctl daemon-reload && systemctl enable --now ha-failover-watcher
#
# Requires: curl, jq, kubectl, base64 - all already present on the VPS
# from earlier in this session.
[Unit]
Description=HA failover watcher - promotes pg-authentik to primary if home's etcd heartbeat goes stale (majority-confirmed via etcd quorum)
After=network.target k3s.service

[Service]
ExecStart=/usr/local/bin/ha-failover-watcher.sh
Restart=always
RestartSec=5
User=root

[Install]
WantedBy=multi-user.target