diff options
| -rw-r--r-- | lib/types.nix | 4 | ||||
| -rw-r--r-- | tv/2configs/binary-cache/default.nix | 8 | ||||
| -rw-r--r-- | tv/3modules/charybdis/default.nix | 11 | ||||
| -rw-r--r-- | tv/3modules/ejabberd/default.nix | 11 | ||||
| -rw-r--r-- | tv/3modules/x0vncserver.nix | 12 |
5 files changed, 38 insertions, 8 deletions
diff --git a/lib/types.nix b/lib/types.nix index 16ccb14..82e184b 100644 --- a/lib/types.nix +++ b/lib/types.nix @@ -256,6 +256,10 @@ rec { type = str; default = "root"; }; + service = mkOption { + type = filename; + default = "secret.service"; + }; source-path = mkOption { type = str; default = toString <secrets> + "/${config.name}"; diff --git a/tv/2configs/binary-cache/default.nix b/tv/2configs/binary-cache/default.nix index 39c944b..970f705 100644 --- a/tv/2configs/binary-cache/default.nix +++ b/tv/2configs/binary-cache/default.nix @@ -9,8 +9,12 @@ }; systemd.services.nix-serve = { - requires = ["secret.service"]; - after = ["secret.service"]; + after = [ + config.krebs.secret.files.binary-cache-seckey.service + ]; + requires = [ + config.krebs.secret.files.binary-cache-seckey.service + ]; }; krebs.secret.files.binary-cache-seckey = { diff --git a/tv/3modules/charybdis/default.nix b/tv/3modules/charybdis/default.nix index 62a7037..3809da4 100644 --- a/tv/3modules/charybdis/default.nix +++ b/tv/3modules/charybdis/default.nix @@ -51,8 +51,15 @@ in { systemd.services.charybdis = { wantedBy = [ "multi-user.target" ]; - requires = [ "secret.service" ]; - after = [ "network-online.target" "secret.service" ]; + after = [ + config.krebs.secret.files.charybdis-ssl_dh_params.service + config.krebs.secret.files.charybdis-ssl_private_key.service + "network-online.target" + ]; + requires = [ + config.krebs.secret.files.charybdis-ssl_dh_params.service + config.krebs.secret.files.charybdis-ssl_private_key.service + ]; environment = { BANDB_DBPATH = "${cfg.user.home}/ban.db"; }; diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index f16dfac..b995c14 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -95,8 +95,15 @@ in { systemd.services.ejabberd = { wantedBy = [ "multi-user.target" ]; - requires = [ "secret.service" ]; - after = [ "network.target" "secret.service" ]; + after = [ + config.krebs.secret.files.ejabberd-certfile.service + config.krebs.secret.files.ejabberd-s2s_certfile.service + "network.target" + ]; + requires = [ + config.krebs.secret.files.ejabberd-certfile.service + config.krebs.secret.files.ejabberd-s2s_certfile.service + ]; serviceConfig = { ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}"; ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground"; diff --git a/tv/3modules/x0vncserver.nix b/tv/3modules/x0vncserver.nix index 44fed59..8b9cfa8 100644 --- a/tv/3modules/x0vncserver.nix +++ b/tv/3modules/x0vncserver.nix @@ -36,8 +36,16 @@ in { x0vncserver-pwfile = cfg.pwfile; }; systemd.services.x0vncserver = { - after = [ "graphical.target" "secret.service" ]; - requires = [ "graphical.target" "secret.service" ]; + after = [ + config.krebs.secret.files.x0vncserver-pwfile.service + "graphical.target" + ]; + partOf = [ + config.krebs.secret.files.x0vncserver-pwfile.service + ]; + requires = [ + "graphical.target" + ]; serviceConfig = { ExecStart = "${pkgs.tigervnc}/bin/x0vncserver ${toString [ "-display ${cfg.display}" |