infra/scripts/vault-token-renew.service

[Unit]
Description=Renew the periodic Vault/OpenBao token in ~/.vault-token
Documentation=https://github.com/ViktorBarzin/infra/blob/master/scripts/vault-token-renew.sh
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
ExecStart=%h/.local/bin/vault-token-renew
vault-token-renew: version the devvm renewer + user units in the repo The devvm periodic Vault admin token (token-devvm-wizard, period=768h, policies default+sops-admin+vault-admin) is kept alive by a systemd user timer, but the renewer script + units lived only under ~/.local/bin and ~/.config/systemd/user — lost on a devvm rebuild. Move them into the repo as the source of truth so a rebuild can restore them. (version-only scope: behavior unchanged; no canonical-file/self-heal added.) - scripts/vault-token-renew.{sh,service,timer}: renewer + user units, refactored into pure drift-guard functions + a guarded main (behavior identical; deployed live and verified still renewing with full write access). - scripts/test-vault-token-renew.sh: unit-tests the drift guard + lookup-JSON parsing, incl. the 2026-06-05 woodpecker-clobber case (17 assertions). - docs/runbooks/vault-token-renew-devvm.md: deploy, mint/re-mint, health-check, drift recovery. - docs/architecture/secrets.md: correct the stale '~/.vault-token = OIDC token' description for devvm. [ci skip] Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> 2026-06-07 16:26:01 +00:00			`[Unit]`
			`Description=Renew the periodic Vault/OpenBao token in ~/.vault-token`
			`Documentation=https://github.com/ViktorBarzin/infra/blob/master/scripts/vault-token-renew.sh`
			`Wants=network-online.target`
			`After=network-online.target`

			`[Service]`
			`Type=oneshot`
			`ExecStart=%h/.local/bin/vault-token-renew`