# Second line of defence behind ip_nonlocal_bind: a bind that fails for any other
# reason must not leave the box unreachable until somebody walks to it. Retry
# forever rather than tripping the default start limit and giving up.
#
# RestartPreventExitStatus= is the load-bearing line. sshd exits 255 when it cannot
# bind a ListenAddress, and Debian's packaged unit lists 255 as unrecoverable, so
# Restart=on-failure alone is inert against the exact failure this file exists for.
#
# No ordering against tailscaled: sshd binds the wildcards, so it needs no address
# tailscaled creates. Waiting for tailscaled would only make every sshd start — the one
# at boot included — hostage to a daemon that has nothing to do with the bind.
[Unit]
StartLimitIntervalSec=0

[Service]
RestartPreventExitStatus=
Restart=on-failure
RestartSec=5