[Unit]
Description=Axiom Zero — SSH Reverse Tunnel to noctualabs.tech
Documentation=https://noctualabs.tech
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=cade
Environment="AUTOSSH_GATETIME=0"
Environment="AUTOSSH_LOGFILE=/home/cade/.axiom-zero/autossh.log"

# Maintains a persistent reverse tunnel:
#   Remote port 9085 on noctualabs.tech → Pi 5 localhost:8085
#   Remote port 9443 on noctualabs.tech → Pi 5 localhost:7443 (mTLS)
#
# EDIT: Replace 'user@noctualabs.tech' with your actual SSH login.
#       Run once manually first to accept host key:
#       ssh -i ~/.ssh/axiom_tunnel_key user@noctualabs.tech
ExecStart=/usr/bin/autossh \
    -M 0 \
    -N \
    -o "ServerAliveInterval=30" \
    -o "ServerAliveCountMax=3" \
    -o "ExitOnForwardFailure=yes" \
    -o "StrictHostKeyChecking=no" \
    -o "ConnectTimeout=10" \
    -o "TCPKeepAlive=yes" \
    -i /home/cade/.ssh/axiom_tunnel_key \
    -R 9085:localhost:8085 \
    -R 9443:localhost:7443 \
    user@noctualabs.tech

Restart=always
RestartSec=10s
StartLimitInterval=0

[Install]
WantedBy=multi-user.target