Still can't get my home directory to unmount reliably. The pam module is present in common-session-noninteractive and the .service hack doesn't seem to work.
Checking journalctl, there are a few directory not found errors suggesting the unmount is firing at the wrong time? Also, it requires systemctl --user enable SERVICE_NAME.service each logon which makes this whole process redundant. Can we make this reliably unmount? I've been trying to solve this problem for the best part of 2 days now and it's a security concern. Thanks.