# kb-mail-sync.service — faza mailowa Krok 7 (recon kb/audits/mail-sync-2026-08-06.md §3.3).
# Host-level oneshot on PIHA, 1:1 with the kb-ingest pattern: the job needs the canonical
# .eml archive (local path), kb-postgres (localhost:5433) and outbound TLS to two IMAP
# servers. Containerizing it would buy nothing.
#
# NOT ENABLED BY THE REPO. Installation and activation are the operator's steps — see
# kb/runbooks/mail-sync-run.md. Nothing here starts on its own after a `git pull`.
#
# EnvironmentFile is read by systemd AS ROOT before dropping to User=oskar, so the IMAP app
# passwords in /opt/homelab/kb/.env (root-owned 0600) reach the process without ever being
# readable by `oskar` at rest. Keep that property: do not "fix" the file's ownership.
[Unit]
Description=KB incremental IMAP mail sync (gmail + fastmail)
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
User=oskar
EnvironmentFile=/opt/homelab/kb/.env
WorkingDirectory=/opt/homelab/kb
ExecStart=/opt/homelab/kb/kb-mail-sync-run.sh