e888b00a6b
This fixes an issue causing secret-trigger-*.service to be restarted on every activation because after triggering these services are dead, this in turn causes restarts of secret-*.service. And finally this caused the issue of always restarting tinc services as they are PartOf= a couple of secert-*.service.
59 lines
1.6 KiB
Nix
59 lines
1.6 KiB
Nix
with import <stockholm/lib>;
|
|
{ config, lib, pkgs, ... }: let
|
|
cfg = config.krebs.secret;
|
|
in {
|
|
options.krebs.secret = {
|
|
directory = mkOption {
|
|
default = toString <secrets>;
|
|
type = types.absolute-pathname;
|
|
};
|
|
file = mkOption {
|
|
default = relpath: "${cfg.directory}/${relpath}";
|
|
readOnly = true;
|
|
};
|
|
files = mkOption {
|
|
type = with types; attrsOf secret-file;
|
|
default = {};
|
|
};
|
|
};
|
|
config = lib.mkIf (cfg.files != {}) {
|
|
systemd.paths =
|
|
mapAttrs'
|
|
(name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
|
|
wantedBy = ["multi-user.target"];
|
|
pathConfig.PathChanged = file.source-path;
|
|
})
|
|
cfg.files;
|
|
systemd.services =
|
|
mapAttrs'
|
|
(name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = "${pkgs.systemd}/bin/systemctl restart ${shell.escape file.service}";
|
|
};
|
|
})
|
|
cfg.files
|
|
//
|
|
mapAttrs'
|
|
(name: file: nameValuePair "secret-${systemd.encodeName name}" {
|
|
wantedBy = ["multi-user.target"];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = "yes";
|
|
ExecStart = toString [
|
|
"${pkgs.coreutils}/bin/install"
|
|
"-D"
|
|
"--compare"
|
|
"--verbose"
|
|
"--mode=${file.mode}"
|
|
"--owner=${file.owner.name}"
|
|
"--group=${file.group-name}"
|
|
file.source-path
|
|
file.path
|
|
];
|
|
};
|
|
})
|
|
cfg.files;
|
|
};
|
|
}
|