[Unit]
Description=Roll today's todo note forward from the most recent one
Documentation=https://github.com/connorjohnstone/todo
After=network-online.target remote-fs.target
Wants=remote-fs.target

[Service]
Type=oneshot
User=connor
Group=connor
ExecStart=/home/connor/.local/lib/todo/rollover.py
# The notes live on an NFS mount, so a stalled server must not wedge the timer.
TimeoutStartSec=120
PrivateTmp=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/home/connor/docs/notes/todo
NoNewPrivileges=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictSUIDSGID=true