# Template instantiated by another unit's OnFailure=. The instance name is the
# FAILING unit (passed as %n by the referrer), so one template covers every
# service on the box.
#
# ⚠ This unit deliberately has NO OnFailure of its own. A notifier that
# reported its own failures would be reported by another notifier, and a
# notification loop is the one bug that pages you forever. The script carries
# the same guard independently.
[Unit]
Description=Report %i entering failed state to the althing infra-ops inbox

[Service]
Type=oneshot
Environment=ALTHING_HANDLE=infra-ops
Environment=ALTHING_POST_OFFICE=http://10.100.50.40:8390
Environment=POSTBOX=%h/.local/bin/postbox
Environment=ALERT_RECIPIENT=infra-ops
# ⚠ %i, NEVER %I. %I UNESCAPES the instance name, and systemd escaping maps
# "-" to "/" -- so a hooked unit called althing-po-herald.service arrives as
# "althing/po/herald.service": wrong name in the subject, and a spool path that
# tries to create directories. Caught by the acceptance test on 2026-09-22,
# which fired with %I and delivered a message naming a unit that does not exist.
# The referring unit passes %n RAW (never escaped), so the literal %i is right.
ExecStart=%h/.local/bin/althing-notify-failure %i
# The notifier must not hang: a stuck postbox call would leave a oneshot
# activating forever and mask the very failure it was invoked for.
TimeoutStartSec=60