74 lines
2.3 KiB
Nix
74 lines
2.3 KiB
Nix
{ config, pkgs, lib, ... }: let {
|
|
|
|
slib = import ../../lib/pure.nix { inherit lib; };
|
|
|
|
body.options.krebs.systemd.services = lib.mkOption {
|
|
default = {};
|
|
type = lib.types.attrsOf (lib.types.submodule (cfg_: let
|
|
serviceName = cfg_.config._module.args.name;
|
|
cfg = config.systemd.services.${serviceName} // cfg_.config;
|
|
in {
|
|
options = {
|
|
credentialPaths = lib.mkOption {
|
|
default =
|
|
lib.sort
|
|
lib.lessThan
|
|
(lib.filter
|
|
slib.types.absolute-pathname.check
|
|
(map
|
|
(slib.compose [ slib.maybeHead (builtins.match "[^:]*:(.*)") ])
|
|
(lib.toList cfg.serviceConfig.LoadCredential)));
|
|
readOnly = true;
|
|
};
|
|
credentialUnitName = lib.mkOption {
|
|
default = "trigger-${slib.systemd.encodeName serviceName}";
|
|
readOnly = true;
|
|
};
|
|
restartIfCredentialsChange = lib.mkOption {
|
|
default = false;
|
|
description = ''
|
|
Whether to restart the service whenever any of its credentials
|
|
change. Only credentials with an absolute path in LoadCredential=
|
|
are supported.
|
|
'';
|
|
type = lib.types.bool;
|
|
};
|
|
};
|
|
}));
|
|
};
|
|
|
|
body.config.systemd = lib.mkMerge (lib.mapAttrsToList (serviceName: cfg: {
|
|
paths.${cfg.credentialUnitName} = {
|
|
wantedBy = [ "multi-user.target" ];
|
|
pathConfig.PathChanged = cfg.credentialPaths;
|
|
};
|
|
services.${cfg.credentialUnitName} = {
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
StateDirectory = "credentials";
|
|
ExecStart = pkgs.writeDash "${cfg.credentialUnitName}.sh" ''
|
|
set -efu
|
|
|
|
PATH=${lib.makeBinPath [
|
|
pkgs.coreutils
|
|
pkgs.diffutils
|
|
pkgs.systemd
|
|
]}
|
|
|
|
cache=/var/lib/credentials/${slib.shell.escape serviceName}.sha1sum
|
|
tmpfile=$(mktemp -t "$(basename "$cache")".XXXXXXXX)
|
|
trap 'rm -f "$tmpfile"' EXIT
|
|
|
|
sha1sum ${toString cfg.credentialPaths} > "$tmpfile"
|
|
if test -f "$cache" && cmp -s "$tmpfile" "$cache"; then
|
|
exit
|
|
fi
|
|
mv "$tmpfile" "$cache"
|
|
|
|
systemctl restart ${slib.shell.escape serviceName}
|
|
'';
|
|
};
|
|
};
|
|
}) config.krebs.systemd.services);
|
|
}
|