From 08ae8b7882cac615c5aa6cd41204e2b8f1b1fa7e Mon Sep 17 00:00:00 2001
From: Jelle Spreeuwenberg <mail@jelles.net>
Date: Sat, 19 Sep 2026 11:07:21 +0200
Subject: [PATCH] mount sharepoint instead

---
 docs/constellation-work.md                    | 19 ++++---
 modules/capabilities/sharepoint-reference.nix | 52 +++++++++----------
 2 files changed, 37 insertions(+), 34 deletions(-)

diff --git a/docs/constellation-work.md b/docs/constellation-work.md
index 15e55a9..1e4b56c 100644
--- a/docs/constellation-work.md
+++ b/docs/constellation-work.md
@@ -87,13 +87,18 @@ coherent commit before starting unrelated work.
   Codex has agent-deck notifications and hooks enabled. Shared Context7/NixOS skills
   live under `.agents/skills`.
   Zellij is also declared on workstations. Further project workflow work is deferred.
-- **SharePoint:** Zenith declares an hourly service syncing `company-sharepoint:`
-  into `~/.local/share/yookr-reference/sharepoint/Algemeen` and
-  `company-sharepoint-projecten:` into `Projecten`. Each invocation has
-  `--max-delete 100`; new files use `UMask=0077`. The latest implementation only
-  checks for `rclone.conf`; the old environment-file gate is gone. Archived setup
-  instructions describe an earlier version. Consent, remote configuration and
-  synchronization state were not inspected during this cleanup.
+- **SharePoint:** Zenith mounts `company-sharepoint:` at
+  `~/.local/share/yookr-reference/sharepoint/Algemeen` and
+  `company-sharepoint-projecten:` at `Projecten` using the user services
+  `sharepoint-reference-algemeen` and `sharepoint-reference-projecten`.
+  These read-only reference mounts stream files on demand with no VFS disk cache
+  and a 16 MiB memory buffer per open file. Internet access is required; directory
+  listings are cached in memory for five minutes. Credentials stay in
+  `~/.config/rclone/rclone.conf`. The previous hourly mirror is removed.
+  When migrating another existing mirror, stop its sync timer and service,
+  verify local files against their remotes with `rclone check --one-way`, and move
+  the mirror aside before starting the mounts. Remove verified local copies only
+  after checking that the mounts work; preserve unmatched files separately.
 - **Remote support:** Zenith enables TeamViewer. Temporary Xorg/Xfce settings are
   comments only. The purpose beyond remote support and runtime acceptance were
   not recorded; preserve the change without calling it a settled design.
diff --git a/modules/capabilities/sharepoint-reference.nix b/modules/capabilities/sharepoint-reference.nix
index b1956c3..cb8dd15 100644
--- a/modules/capabilities/sharepoint-reference.nix
+++ b/modules/capabilities/sharepoint-reference.nix
@@ -10,37 +10,35 @@
     let
       rcloneConfig = "${config.xdg.configHome}/rclone/rclone.conf";
       destination = "${config.xdg.dataHome}/yookr-reference/sharepoint";
+      libraries = {
+        Algemeen = "company-sharepoint:";
+        Projecten = "company-sharepoint-projecten:";
+      };
     in
     {
-      systemd.user.services.sharepoint-reference-sync = {
-        Unit = {
-          Description = "Refresh the local SharePoint reference mirror";
-          ConditionPathExists = rcloneConfig;
-          # Let an in-flight sync finish; activation must not restart and wait for it.
-          X-SwitchMethod = "keep-old";
-        };
+      systemd.user.services = lib.mapAttrs' (
+        name: remote:
+        lib.nameValuePair "sharepoint-reference-${lib.toLower name}" {
+          Unit = {
+            Description = "SharePoint ${name} on-demand reference mount";
+            ConditionPathExists = rcloneConfig;
+          };
 
-        Service = {
-          Type = "oneshot";
-          UMask = "0077";
-          ExecStart = [
-            "${lib.getExe pkgs.rclone} --config ${rcloneConfig} sync company-sharepoint: ${destination}/Algemeen --max-delete 100"
-            "${lib.getExe pkgs.rclone} --config ${rcloneConfig} sync company-sharepoint-projecten: ${destination}/Projecten --max-delete 100"
-          ];
-        };
-      };
+          Service = {
+            Type = "notify";
+            UMask = "0077";
+            Environment = "PATH=/run/wrappers/bin:${lib.makeBinPath [ pkgs.fuse3 ]}";
+            ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${destination}/${name}";
+            # Stream reads into memory; never retain file contents in a disk cache.
+            # Keep the mount read-only, matching its role as reference material.
+            ExecStart = "${lib.getExe pkgs.rclone} mount ${remote} ${destination}/${name} --config ${rcloneConfig} --read-only --vfs-cache-mode off --buffer-size 16M --dir-cache-time 5m --umask 077";
+            Restart = "on-failure";
+            RestartSec = "30s";
+          };
 
-      systemd.user.timers.sharepoint-reference-sync = {
-        Unit.Description = "Refresh the local SharePoint reference mirror hourly";
-
-        Timer = {
-          OnCalendar = "hourly";
-          Persistent = true;
-          RandomizedDelaySec = "10m";
-        };
-
-        Install.WantedBy = [ "timers.target" ];
-      };
+          Install.WantedBy = [ "default.target" ];
+        }
+      ) libraries;
     };
 
   flake.modules.nixos.sharepoint-reference = {