[Unit]
Description=Watch /root/.ssh/authorized_keys and re-install the managed root SSH key
Documentation=man:sshd(8)
After=local-fs.target

[Path]
# PathChanged covers deletion / rename / creation of the file,
# PathModified covers in-place edits (key stripped or file truncated).
# ensure-root-ssh-key.service only writes when a managed key is missing, so
# its own writes settle after one extra no-op run instead of looping.
PathChanged=/root/.ssh/authorized_keys
PathModified=/root/.ssh/authorized_keys
Unit=ensure-root-ssh-key.service

[Install]
WantedBy=multi-user.target