stockholm/krebs/3modules/systemd.nix
2023-06-21 14:47:04 +02:00

74 lines
2.3 KiB
Nix

{ config, pkgs, lib, ... }: let {
slib = import ../../lib/pure.nix { inherit lib; };
body.options.krebs.systemd.services = lib.mkOption {
default = {};
type = lib.types.attrsOf (lib.types.submodule (cfg_: let
serviceName = cfg_.config._module.args.name;
cfg = config.systemd.services.${serviceName} // cfg_.config;
in {
options = {
credentialPaths = lib.mkOption {
default =
lib.sort
lib.lessThan
(lib.filter
slib.types.absolute-pathname.check
(map
(slib.compose [ slib.maybeHead (builtins.match "[^:]*:(.*)") ])
(lib.toList cfg.serviceConfig.LoadCredential)));
readOnly = true;
};
credentialUnitName = lib.mkOption {
default = "trigger-${slib.systemd.encodeName serviceName}";
readOnly = true;
};
restartIfCredentialsChange = lib.mkOption {
default = false;
description = ''
Whether to restart the service whenever any of its credentials
change. Only credentials with an absolute path in LoadCredential=
are supported.
'';
type = lib.types.bool;
};
};
}));
};
body.config.systemd = lib.mkMerge (lib.mapAttrsToList (serviceName: cfg: {
paths.${cfg.credentialUnitName} = {
wantedBy = [ "multi-user.target" ];
pathConfig.PathChanged = cfg.credentialPaths;
};
services.${cfg.credentialUnitName} = {
serviceConfig = {
Type = "oneshot";
StateDirectory = "credentials";
ExecStart = pkgs.writeDash "${cfg.credentialUnitName}.sh" ''
set -efu
PATH=${lib.makeBinPath [
pkgs.coreutils
pkgs.diffutils
pkgs.systemd
]}
cache=/var/lib/credentials/${slib.shell.escape serviceName}.sha1sum
tmpfile=$(mktemp -t "$(basename "$cache")".XXXXXXXX)
trap 'rm -f "$tmpfile"' EXIT
sha1sum ${toString cfg.credentialPaths} > "$tmpfile"
if test -f "$cache" && cmp -s "$tmpfile" "$cache"; then
exit
fi
mv "$tmpfile" "$cache"
systemctl restart ${slib.shell.escape serviceName}
'';
};
};
}) config.krebs.systemd.services);
}