# Managed by Ansible — do not edit manually.
#
# Watches Caddy's on-disk cert for mqtt.{{ domain }} and fires
# mqtt-cert-sync.service on every change (initial issuance + every renewal).
# See sync-mqtt-cert.sh.j2 for the "unverified path" caveat — if Caddy's
# storage layout doesn't match, this unit simply never fires and mosquitto
# keeps using its self-signed placeholder cert (see mosquitto/entrypoint.sh)
# rather than failing loudly, so check `systemctl status mqtt-cert-sync.path`
# after the first deploy.
[Unit]
Description=Watch for a renewed MQTT TLS cert from Caddy (mqtt.{{ domain }})

[Path]
PathChanged=/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mqtt.{{ domain }}/mqtt.{{ domain }}.crt
Unit=mqtt-cert-sync.service

[Install]
WantedBy=multi-user.target