[Unit]
Description=Unseal HashiCorp Vault using a TPM 2.0 sealed key
Documentation=file:/etc/vault.d/tpm2.env
Requires=vault.service
After=vault.service

[Service]
Type=oneshot
RemainAfterExit=yes
EnvironmentFile=/etc/vault.d/tpm2.env
ExecStart=/usr/local/sbin/vault-tpm2-unseal.sh

[Install]
WantedBy=vault.service