krebs.secret: restart units on secret change

krebs/3modules/exim-smarthost.nix

@@ -26,6 +26,7 @@ let
           private_key = mkOption {
             type = types.secret-file;
             default = {
+              name = "exim.dkim_private_key/${config.domain}";
               path = "/run/krebs.secret/${config.domain}.dkim_private_key";
               owner.name = "exim";
               source-path = toString <secrets> + "/${config.domain}.dkim.priv";
@@ -118,7 +119,7 @@ let
         after = flip map cfg.dkim (dkim:
           config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
         );
-        requires = flip map cfg.dkim (dkim:
+        partOf = flip map cfg.dkim (dkim:
           config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
         );
       };

krebs/3modules/repo-sync.nix

@@ -124,6 +124,7 @@ let
     privateKeyFile = mkOption {
       type = types.secret-file;
       default = {
+        name = "repo-sync-key";
         path = "${cfg.stateDir}/ssh.priv";
         owner = cfg.user;
         source-path = toString <secrets> + "/repo-sync.ssh.key";
@@ -170,7 +171,7 @@ let
           config.krebs.secret.files.repo-sync-key.service
           "network.target"
         ];
-        requires = [
+        partOf = [
           config.krebs.secret.files.repo-sync-key.service
         ];
 

krebs/3modules/secret.nix

@@ -1,4 +1,5 @@
-{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }: let
   cfg = config.krebs.secret;
 in {
   options.krebs.secret = {
@@ -8,32 +9,43 @@ in {
     };
   };
   config = lib.mkIf (cfg.files != {}) {
-    systemd.services.secret = let
+    systemd.paths =
-      # TODO fail if two files have the same path but differ otherwise
+      mapAttrs'
-      files = unique (map (flip removeAttrs ["_module"])
+        (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
-                          (attrValues cfg.files));
+          wantedBy = ["multi-user.target"];
-    in {
+          pathConfig.PathChanged = file.source-path;
+        })
+        cfg.files;
+    systemd.services =
+      mapAttrs'
+        (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+          wantedBy = ["multi-user.target"];
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = "${pkgs.systemd}/bin/systemctl restart ${file.service}";
+          };
+        })
+        cfg.files
+      //
+      mapAttrs'
+        (name: file: nameValuePair "secret-${systemd.encodeName name}" {
+          wantedBy = ["multi-user.target"];
           serviceConfig = {
             Type = "oneshot";
             RemainAfterExit = "yes";
-        SyslogIdentifier = "secret";
+            ExecStart = toString [
-        ExecStart = pkgs.writeDash "install-secret-files" ''
+              "${pkgs.coreutils}/bin/install"
-          exit_code=0
+              "-D"
-          ${concatMapStringsSep "\n" (file: ''
+              "--compare"
-            ${pkgs.coreutils}/bin/install \
+              "--verbose"
-                  -D \
+              "--mode=${file.mode}"
-                  --compare \
+              "--owner=${file.owner.name}"
-                  --verbose \
+              "--group=${file.group-name}"
-                  --mode=${shell.escape file.mode} \
+              file.source-path
-                  --owner=${shell.escape file.owner.name} \
+              file.path
-                  --group=${shell.escape file.group-name} \
+            ];
-                  ${shell.escape file.source-path} \
-                  ${shell.escape file.path} \
-                || exit_code=1
-          '') files}
-          exit $exit_code
-        '';
-      };
           };
+        })
+        cfg.files;
   };
 }

krebs/3modules/tinc.nix

@@ -158,6 +158,7 @@ let
         privkey = mkOption {
           type = types.secret-file;
           default = {
+            name = "${tinc.config.netname}.rsa_key.priv";
             path = "${tinc.config.user.home}/tinc.rsa_key.priv";
             owner = tinc.config.user;
             source-path = toString <secrets> + "/${tinc.config.netname}.rsa_key.priv";
@@ -223,7 +224,7 @@ let
           config.krebs.secret.files."${netname}.rsa_key.priv".service
           "network.target"
         ];
-        requires = [
+        partOf = [
           config.krebs.secret.files."${netname}.rsa_key.priv".service
         ];
         wantedBy = [ "multi-user.target" ];

lass/2configs/binary-cache/server.nix

@@ -12,7 +12,7 @@
     after = [
       config.krebs.secret.files.nix-serve-key.service
     ];
-    requires = [
+    partOf = [
       config.krebs.secret.files.nix-serve-key.service
     ];
   };

lass/2configs/websites/sqlBackup.nix

@@ -17,7 +17,7 @@
     after = [
       config.krebs.secret.files.mysql_rootPassword.service
     ];
-    requires = [
+    partOf = [
       config.krebs.secret.files.mysql_rootPassword.service
     ];
   };

lass/3modules/ejabberd/default.nix

@@ -17,6 +17,7 @@ in {
     certfile = mkOption {
       type = types.secret-file;
       default = {
+        name = "ejabberd-certfile";
         path = "${cfg.user.home}/ejabberd.pem";
         owner = cfg.user;
         source-path = "/var/lib/acme/lassul.us/full.pem";
@@ -25,6 +26,7 @@ in {
     dhfile = mkOption {
       type = types.secret-file;
       default = {
+        name = "ejabberd-dhfile";
         path = "${cfg.user.home}/dhparams.pem";
         owner = cfg.user;
         source-path = "/dev/null";
@@ -79,7 +81,7 @@ in {
         config.krebs.secret.files.ejabberd-s2s_certfile.service
         "network.target"
       ];
-      requires = [
+      partOf = [
         config.krebs.secret.files.ejabberd-certfile.service
         config.krebs.secret.files.ejabberd-s2s_certfile.service
       ];

lib/default.nix

@@ -8,6 +8,9 @@ let
     krebs = import ./krebs lib;
     krops = import ../submodules/krops/lib;
     shell = import ./shell.nix { inherit lib; };
+    systemd = {
+      encodeName = replaceChars ["/"] ["\\x2f"];
+    };
     types = nixpkgs-lib.types // import ./types.nix { inherit lib; };
     xml = import ./xml.nix { inherit lib; };
 

lib/types.nix

@@ -238,7 +238,7 @@ rec {
   secret-file = submodule ({ config, ... }: {
     options = {
       name = mkOption {
-        type = filename;
+        type = pathname;
         default = config._module.args.name;
       };
       path = mkOption {
@@ -257,8 +257,8 @@ rec {
         default = "root";
       };
       service = mkOption {
-        type = filename;
+        type = systemd.unit-name;
-        default = "secret.service";
+        default = "secret-${lib.systemd.encodeName config.name}.service";
       };
       source-path = mkOption {
         type = str;

makefu/2configs/binary-cache/server.nix

@@ -12,7 +12,7 @@
     after = [
       config.krebs.secret.files.nix-serve-key.service
     ];
-    requires = [
+    partOf = [
       config.krebs.secret.files.nix-serve-key.service
     ];
   };

makefu/3modules/netdata.nix

@@ -74,7 +74,7 @@ in
       after = [
         config.krebs.secret.files.netdata-stream.service
       ];
-      requires = [
+      partOf = [
         config.krebs.secret.files.netdata-stream.service
       ];
     };

tv/2configs/binary-cache/default.nix

@@ -12,7 +12,7 @@
     after = [
       config.krebs.secret.files.binary-cache-seckey.service
     ];
-    requires = [
+    partOf = [
       config.krebs.secret.files.binary-cache-seckey.service
     ];
   };

tv/3modules/charybdis/default.nix

@@ -17,6 +17,7 @@ in {
     ssl_dh_params = mkOption {
       type = types.secret-file;
       default = {
+        name = "charybdis-ssl_dh_params";
         path = "${cfg.user.home}/dh.pem";
         owner = cfg.user;
         source-path = toString <secrets> + "/charybdis.dh.pem";
@@ -25,6 +26,7 @@ in {
     ssl_private_key = mkOption {
       type = types.secret-file;
       default = {
+        name = "charybdis-ssl_private_key";
         path = "${cfg.user.home}/ssl.key.pem";
         owner = cfg.user;
         source-path = toString <secrets> + "/charybdis.key.pem";
@@ -56,7 +58,7 @@ in {
         config.krebs.secret.files.charybdis-ssl_private_key.service
         "network-online.target"
       ];
-      requires = [
+      partOf = [
         config.krebs.secret.files.charybdis-ssl_dh_params.service
         config.krebs.secret.files.charybdis-ssl_private_key.service
       ];

tv/3modules/ejabberd/default.nix

@@ -18,6 +18,7 @@ in {
     certfile = mkOption {
       type = types.secret-file;
       default = {
+        name = "ejabberd-certfile";
         path = "${cfg.user.home}/ejabberd.pem";
         owner = cfg.user;
         source-path = toString <secrets> + "/ejabberd.pem";
@@ -26,6 +27,7 @@ in {
     dhfile = mkOption {
       type = types.secret-file;
       default = {
+        name = "ejabberd-dhfile";
         path = "${cfg.user.home}/dhparams.pem";
         owner = cfg.user;
         source-path = "/dev/null";
@@ -100,7 +102,7 @@ in {
         config.krebs.secret.files.ejabberd-s2s_certfile.service
         "network.target"
       ];
-      requires = [
+      partOf = [
         config.krebs.secret.files.ejabberd-certfile.service
         config.krebs.secret.files.ejabberd-s2s_certfile.service
       ];

tv/3modules/x0vncserver.nix

@@ -12,6 +12,7 @@ in {
     enable = mkEnableOption "tv.x0vncserver";
     pwfile = mkOption {
       default = {
+        name = "x0vncserver-pwfile";
         owner = cfg.user;
         path = "${cfg.user.home}/.vncpasswd";
         source-path = toString <secrets> + "/vncpasswd";