[Unit]
Before=virtsecretd.service
Before=libvirtd.service
ConditionPathExists=!/var/lib/libvirt/secrets/secrets-encryption-key

[Service]
Type=oneshot
UMask=0077
ExecStart=/usr/bin/sh -c 'dd if=/dev/random status=none bs=32 count=1 | systemd-creds encrypt --name=secrets-encryption-key - /var/lib/libvirt/secrets/secrets-encryption-key'
