From 025570dea106082c7bfec4d8ec5fed55d528ff83 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Torjus=20H=C3=A5kestad?= <torjus@usit.uio.no>
Date: Fri, 6 Feb 2026 19:35:59 +0100
Subject: [PATCH] monitoring: fix openbao token refresh timer not triggering

RemainAfterExit=true kept the service in "active" state, which
prevented OnUnitActiveSec from scheduling new triggers since there
was no new "activation" event. Removing it allows the service to
properly go inactive, enabling the timer to reschedule correctly.

Also fix ExecStart to use lib.getExe for proper path resolution
with writeShellApplication.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 services/monitoring/prometheus.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/services/monitoring/prometheus.nix b/services/monitoring/prometheus.nix
index b95033c..57bc86d 100644
--- a/services/monitoring/prometheus.nix
+++ b/services/monitoring/prometheus.nix
@@ -58,8 +58,7 @@ in
 
     serviceConfig = {
       Type = "oneshot";
-      ExecStart = fetchOpenbaoToken;
-      RemainAfterExit = true;
+      ExecStart = lib.getExe fetchOpenbaoToken;
     };
   };