# The host certificate is the credential for the mTLS Postgres connection and is
# reissued every 24 hours (architecture/generic.md §11). The daemon reads it
# when it opens a connection, so a rotation is picked up by the pool's own
# recycling within the hour — but a restart on change makes it immediate and
# removes the one window where a stale in-memory client cert could be presented.
[Unit]
Description=Watch the host certificate for blackbeard-api

[Path]
PathChanged=/etc/pki/tls/misc/%H.pem
Unit=blackbeard-api-cert-reload.service

[Install]
WantedBy=multi-user.target