# maven-voice-tunnel — the ssh leg that carries the voice wire to homesrv.
#
# Runs on workpc, as a user unit (`systemctl --user`), beside mavgpud.service.
#
# WHY THIS EXISTS AT ALL. internal/voice is plaintext and unauthenticated.
# Its own server doc says production binds inside the wg tunnel, because "the
# wg layer IS the L0 floor". workpc is not a wg peer, it sits on wlan0. So ssh
# is the substitute floor: it authenticates with his key and encrypts the leg,
# and mavend's published port stays on homesrv loopback (127.0.0.1:9110).
# Nothing about this puts a Maven port on the LAN.
#
# Do not replace this with a LAN bind. SurfaceVoice caps acts at L0, so an
# unauthorized speaker could not run a destructive tool. It would still hear
# his facts, his notes and his calendar read back, and L0 does not cap reading.
#
#   install: cp to ~/.config/systemd/user/ on workpc
#            systemctl --user enable --now maven-voice-tunnel.service

[Unit]
Description=SSH tunnel to mavend's voice wire on homesrv
After=network-online.target
Wants=network-online.target

[Service]
# -N: no remote command, forwarding only.
# ExitOnForwardFailure: fail loudly rather than sit up with a dead forward,
# which is what makes Restart meaningful.
# ServerAlive*: a laptop that suspends drops the tunnel silently otherwise.
ExecStart=/usr/bin/ssh -N \
  -o ExitOnForwardFailure=yes \
  -o ServerAliveInterval=30 \
  -o ServerAliveCountMax=3 \
  -o BatchMode=yes \
  -L 127.0.0.1:9100:127.0.0.1:9110 \
  kami@192.168.1.104
Restart=always
RestartSec=5

[Install]
WantedBy=default.target