Mic92
/
stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

types.secret-file: add service option

This commit is contained in:
tv 2020-08-04 20:28:04 +02:00
parent 087fff54f1
commit b5b90b5984
14 changed files with 92 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
krebs/3modules/exim-smarthost.nix
View File

@ -115,8 +115,12 @@ let
}));
systemd.services = mkIf (cfg.dkim != []) {
exim = {
after = [ "secret.service" ];
requires = [ "secret.service" ];
after = flip map cfg.dkim (dkim:
config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
);
requires = flip map cfg.dkim (dkim:
config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
);
};
};
krebs.exim = {

2
krebs/3modules/konsens.nix
View File

@ -56,7 +56,7 @@ let
systemd.services = mapAttrs' (name: repo:
nameValuePair "konsens-${name}" {
after = [ "network.target" "secret.service" ];
after = [ "network.target" ];
path = [ pkgs.git ];
restartIfChanged = false;
serviceConfig = {

8
krebs/3modules/repo-sync.nix
View File

@ -166,7 +166,13 @@ let
});
in nameValuePair "repo-sync-${name}" {
description = "repo-sync";
after = [ "network.target" "secret.service" ];
after = [
config.krebs.secret.files.repo-sync-key.service
"network.target"
];
requires = [
config.krebs.secret.files.repo-sync-key.service
];
environment = {
GIT_SSH_COMMAND = "${pkgs.openssh}/bin/ssh -i ${cfg.stateDir}/ssh.priv";

9
krebs/3modules/tinc.nix
View File

@ -219,9 +219,14 @@ let
iproute = cfg.iproutePackage;
in {
description = "Tinc daemon for ${netname}";
after = [ "network.target" ];
after = [
config.krebs.secret.files."${netname}.rsa_key.priv".service
"network.target"
];
requires = [
config.krebs.secret.files."${netname}.rsa_key.priv".service
];
wantedBy = [ "multi-user.target" ];
requires = [ "secret.service" ];
path = [ tinc iproute ];
serviceConfig = rec {
Restart = "always";

8
lass/2configs/binary-cache/server.nix
View File

@ -9,8 +9,12 @@
};
systemd.services.nix-serve = {
requires = ["secret.service"];
after = ["secret.service"];
after = [
config.krebs.secret.files.nix-serve-key.service
];
requires = [
config.krebs.secret.files.nix-serve-key.service
];
};
krebs.secret.files.nix-serve-key = {
path = "/run/secret/nix-serve.key";

8
lass/2configs/websites/sqlBackup.nix
View File

@ -14,8 +14,12 @@
};
systemd.services.mysql = {
requires = [ "secret.service" ];
after = [ "secret.service" ];
after = [
config.krebs.secret.files.mysql_rootPassword.service
];
requires = [
config.krebs.secret.files.mysql_rootPassword.service
];
};
lass.mysqlBackup = {

11
lass/3modules/ejabberd/default.nix
View File

@ -74,8 +74,15 @@ in {
systemd.services.ejabberd = {
wantedBy = [ "multi-user.target" ];
requires = [ "secret.service" ];
after = [ "network.target" "secret.service" ];
after = [
config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
"network.target"
];
requires = [
config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
];
serviceConfig = {
ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
ExecStart = "${cfg.pkgs.ejabberdctl}/bin/ejabberdctl foreground";

4
lib/types.nix
View File

@ -256,6 +256,10 @@ rec {
type = str;
default = "root";
};
service = mkOption {
type = filename;
default = "secret.service";
};
source-path = mkOption {
type = str;
default = toString <secrets> + "/${config.name}";

8
makefu/2configs/binary-cache/server.nix
View File

@ -9,8 +9,12 @@
};
systemd.services.nix-serve = {
requires = ["secret.service"];
after = ["secret.service"];
after = [
config.krebs.secret.files.nix-serve-key.service
];
requires = [
config.krebs.secret.files.nix-serve-key.service
];
};
krebs.secret.files.nix-serve-key = {
path = "/run/secret/nix-serve.key";

8
makefu/3modules/netdata.nix
View File

@ -71,8 +71,12 @@ in
};
config = mkIf cfg.enable {
systemd.services.netdata = {
requires = [ "secret.service" ];
after = [ "secret.service" ];
after = [
config.krebs.secret.files.netdata-stream.service
];
requires = [
config.krebs.secret.files.netdata-stream.service
];
};
krebs.secret.files.netdata-stream = {
path = "/run/secret/netdata-stream.conf";

8
tv/2configs/binary-cache/default.nix
View File

@ -9,8 +9,12 @@
};
systemd.services.nix-serve = {
requires = ["secret.service"];
after = ["secret.service"];
after = [
config.krebs.secret.files.binary-cache-seckey.service
];
requires = [
config.krebs.secret.files.binary-cache-seckey.service
];
};
krebs.secret.files.binary-cache-seckey = {

11
tv/3modules/charybdis/default.nix
View File

@ -51,8 +51,15 @@ in {
systemd.services.charybdis = {
wantedBy = [ "multi-user.target" ];
requires = [ "secret.service" ];
after = [ "network-online.target" "secret.service" ];
after = [
config.krebs.secret.files.charybdis-ssl_dh_params.service
config.krebs.secret.files.charybdis-ssl_private_key.service
"network-online.target"
];
requires = [
config.krebs.secret.files.charybdis-ssl_dh_params.service
config.krebs.secret.files.charybdis-ssl_private_key.service
];
environment = {
BANDB_DBPATH = "${cfg.user.home}/ban.db";
};

11
tv/3modules/ejabberd/default.nix
View File

@ -95,8 +95,15 @@ in {
systemd.services.ejabberd = {
wantedBy = [ "multi-user.target" ];
requires = [ "secret.service" ];
after = [ "network.target" "secret.service" ];
after = [
config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
"network.target"
];
requires = [
config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
];
serviceConfig = {
ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground";

12
tv/3modules/x0vncserver.nix
View File

@ -36,8 +36,16 @@ in {
x0vncserver-pwfile = cfg.pwfile;
};
systemd.services.x0vncserver = {
after = [ "graphical.target" "secret.service" ];
requires = [ "graphical.target" "secret.service" ];
after = [
config.krebs.secret.files.x0vncserver-pwfile.service
"graphical.target"
];
partOf = [
config.krebs.secret.files.x0vncserver-pwfile.service
];
requires = [
"graphical.target"
];
serviceConfig = {
ExecStart = "${pkgs.tigervnc}/bin/x0vncserver ${toString [
"-display ${cfg.display}"