types.secret-file: add service option

krebs/3modules/exim-smarthost.nix

@@ -115,8 +115,12 @@ let
     }));
     systemd.services = mkIf (cfg.dkim != []) {
       exim = {
-        after = [ "secret.service" ];
+        after = flip map cfg.dkim (dkim:
-        requires = [ "secret.service" ];
+          config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
+        );
+        requires = flip map cfg.dkim (dkim:
+          config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
+        );
       };
     };
     krebs.exim = {

krebs/3modules/konsens.nix

@@ -56,7 +56,7 @@ let
 
     systemd.services = mapAttrs' (name: repo:
       nameValuePair "konsens-${name}" {
-        after = [ "network.target" "secret.service" ];
+        after = [ "network.target" ];
         path = [ pkgs.git ];
         restartIfChanged = false;
         serviceConfig = {

krebs/3modules/repo-sync.nix

@@ -166,7 +166,13 @@ let
           });
       in nameValuePair "repo-sync-${name}" {
         description = "repo-sync";
-        after = [ "network.target" "secret.service" ];
+        after = [
+          config.krebs.secret.files.repo-sync-key.service
+          "network.target"
+        ];
+        requires = [
+          config.krebs.secret.files.repo-sync-key.service
+        ];
 
         environment = {
           GIT_SSH_COMMAND = "${pkgs.openssh}/bin/ssh -i ${cfg.stateDir}/ssh.priv";

krebs/3modules/tinc.nix

@@ -219,9 +219,14 @@ let
         iproute = cfg.iproutePackage;
       in {
         description = "Tinc daemon for ${netname}";
-        after = [ "network.target" ];
+        after = [
+          config.krebs.secret.files."${netname}.rsa_key.priv".service
+          "network.target"
+        ];
+        requires = [
+          config.krebs.secret.files."${netname}.rsa_key.priv".service
+        ];
         wantedBy = [ "multi-user.target" ];
-        requires = [ "secret.service" ];
         path = [ tinc iproute ];
         serviceConfig = rec {
           Restart = "always";

lass/2configs/binary-cache/server.nix

@@ -9,8 +9,12 @@
   };
 
   systemd.services.nix-serve = {
-    requires = ["secret.service"];
+    after = [
-    after = ["secret.service"];
+      config.krebs.secret.files.nix-serve-key.service
+    ];
+    requires = [
+      config.krebs.secret.files.nix-serve-key.service
+    ];
   };
   krebs.secret.files.nix-serve-key = {
     path = "/run/secret/nix-serve.key";

lass/2configs/websites/sqlBackup.nix

@@ -14,8 +14,12 @@
   };
 
   systemd.services.mysql = {
-    requires = [ "secret.service" ];
+    after = [
-    after = [ "secret.service" ];
+      config.krebs.secret.files.mysql_rootPassword.service
+    ];
+    requires = [
+      config.krebs.secret.files.mysql_rootPassword.service
+    ];
   };
 
   lass.mysqlBackup = {

lass/3modules/ejabberd/default.nix

@@ -74,8 +74,15 @@ in {
 
     systemd.services.ejabberd = {
       wantedBy = [ "multi-user.target" ];
-      requires = [ "secret.service" ];
+      after = [
-      after = [ "network.target" "secret.service" ];
+        config.krebs.secret.files.ejabberd-certfile.service
+        config.krebs.secret.files.ejabberd-s2s_certfile.service
+        "network.target"
+      ];
+      requires = [
+        config.krebs.secret.files.ejabberd-certfile.service
+        config.krebs.secret.files.ejabberd-s2s_certfile.service
+      ];
       serviceConfig = {
         ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
         ExecStart = "${cfg.pkgs.ejabberdctl}/bin/ejabberdctl foreground";

lib/types.nix

@@ -256,6 +256,10 @@ rec {
         type = str;
         default = "root";
       };
+      service = mkOption {
+        type = filename;
+        default = "secret.service";
+      };
       source-path = mkOption {
         type = str;
         default = toString <secrets> + "/${config.name}";

makefu/2configs/binary-cache/server.nix

@@ -9,8 +9,12 @@
   };
 
   systemd.services.nix-serve = {
-    requires = ["secret.service"];
+    after = [
-    after = ["secret.service"];
+      config.krebs.secret.files.nix-serve-key.service
+    ];
+    requires = [
+      config.krebs.secret.files.nix-serve-key.service
+    ];
   };
   krebs.secret.files.nix-serve-key = {
     path = "/run/secret/nix-serve.key";

makefu/3modules/netdata.nix

@@ -71,8 +71,12 @@ in
   };
   config = mkIf cfg.enable {
     systemd.services.netdata = {
-      requires = [ "secret.service" ];
+      after = [
-      after = [ "secret.service" ];
+        config.krebs.secret.files.netdata-stream.service
+      ];
+      requires = [
+        config.krebs.secret.files.netdata-stream.service
+      ];
     };
     krebs.secret.files.netdata-stream = {
       path = "/run/secret/netdata-stream.conf";

tv/2configs/binary-cache/default.nix

@@ -9,8 +9,12 @@
   };
 
   systemd.services.nix-serve = {
-    requires = ["secret.service"];
+    after = [
-    after = ["secret.service"];
+      config.krebs.secret.files.binary-cache-seckey.service
+    ];
+    requires = [
+      config.krebs.secret.files.binary-cache-seckey.service
+    ];
   };
 
   krebs.secret.files.binary-cache-seckey = {

tv/3modules/charybdis/default.nix

@@ -51,8 +51,15 @@ in {
 
     systemd.services.charybdis = {
       wantedBy = [ "multi-user.target" ];
-      requires = [ "secret.service" ];
+      after = [
-      after = [ "network-online.target" "secret.service" ];
+        config.krebs.secret.files.charybdis-ssl_dh_params.service
+        config.krebs.secret.files.charybdis-ssl_private_key.service
+        "network-online.target"
+      ];
+      requires = [
+        config.krebs.secret.files.charybdis-ssl_dh_params.service
+        config.krebs.secret.files.charybdis-ssl_private_key.service
+      ];
       environment = {
         BANDB_DBPATH = "${cfg.user.home}/ban.db";
       };

tv/3modules/ejabberd/default.nix

@@ -95,8 +95,15 @@ in {
 
     systemd.services.ejabberd = {
       wantedBy = [ "multi-user.target" ];
-      requires = [ "secret.service" ];
+      after = [
-      after = [ "network.target" "secret.service" ];
+        config.krebs.secret.files.ejabberd-certfile.service
+        config.krebs.secret.files.ejabberd-s2s_certfile.service
+        "network.target"
+      ];
+      requires = [
+        config.krebs.secret.files.ejabberd-certfile.service
+        config.krebs.secret.files.ejabberd-s2s_certfile.service
+      ];
       serviceConfig = {
         ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
         ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground";

tv/3modules/x0vncserver.nix

@@ -36,8 +36,16 @@ in {
       x0vncserver-pwfile = cfg.pwfile;
     };
     systemd.services.x0vncserver = {
-      after = [ "graphical.target" "secret.service" ];
+      after = [
-      requires = [ "graphical.target" "secret.service" ];
+        config.krebs.secret.files.x0vncserver-pwfile.service
+        "graphical.target"
+      ];
+      partOf = [
+        config.krebs.secret.files.x0vncserver-pwfile.service
+      ];
+      requires = [
+        "graphical.target"
+      ];
       serviceConfig = {
         ExecStart = "${pkgs.tigervnc}/bin/x0vncserver ${toString [
           "-display ${cfg.display}"