[Unit]
Description=The mesh's internal certificate authority, trusted by this machine
# novox/hq ADR 0147. Starting this unit places the mesh's root among this
# machine's trust anchors; stopping it takes the root away again, which is what
# the host does when the module is no longer assigned here.
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=${dir:state}/anchor install
ExecStop=${dir:state}/anchor remove

[Install]
WantedBy=multi-user.target