[Unit]
Description=veilor-os first-boot admin password setup
Documentation=https://github.com/veilor-org/veilor-os
ConditionPathExists=!/var/lib/veilor-firstboot.done
Before=sddm.service display-manager.service
After=systemd-user-sessions.service plymouth-quit-wait.service
Conflicts=sddm.service

[Service]
Type=oneshot
RemainAfterExit=no
ExecStart=/usr/local/bin/veilor-firstboot
StandardInput=tty
StandardOutput=tty
StandardError=tty
TTYPath=/dev/tty1
TTYReset=yes
TTYVHangup=yes

[Install]
# Real installs default to graphical.target. Without this entry the unit
# never runs on installed systems — admin pw stays at install-time value
# + chage -d 0 expired, SDDM PAM bounces user to a chauthtok screen
# (recoverable but ugly). Live ISO + multi-user.target installs both
# resolve via this list. (Agent 2, 2026-05-05 wave.)
WantedBy=graphical.target multi-user.target