summaryrefslogtreecommitdiffstats
path: root/krebs/3modules
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2020-08-04 22:22:43 +0200
committertv <tv@krebsco.de>2020-08-05 11:16:45 +0200
commitec91d1b83cfad151033433159a04eb7b5381bc73 (patch)
tree4da4eefa1d14a8cd5cca42e9d78a81262ff1fe03 /krebs/3modules
parent4227cadb6823bd4b945b8ea9e766f22b95d26468 (diff)
krebs.secret: restart units on secret change
Diffstat (limited to 'krebs/3modules')
-rw-r--r--krebs/3modules/exim-smarthost.nix3
-rw-r--r--krebs/3modules/repo-sync.nix3
-rw-r--r--krebs/3modules/secret.nix68
-rw-r--r--krebs/3modules/tinc.nix3
4 files changed, 46 insertions, 31 deletions
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index 2a97f9d6e..c5969caac 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -26,6 +26,7 @@ let
private_key = mkOption {
type = types.secret-file;
default = {
+ name = "exim.dkim_private_key/${config.domain}";
path = "/run/krebs.secret/${config.domain}.dkim_private_key";
owner.name = "exim";
source-path = toString <secrets> + "/${config.domain}.dkim.priv";
@@ -118,7 +119,7 @@ let
after = flip map cfg.dkim (dkim:
config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
);
- requires = flip map cfg.dkim (dkim:
+ partOf = flip map cfg.dkim (dkim:
config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
);
};
diff --git a/krebs/3modules/repo-sync.nix b/krebs/3modules/repo-sync.nix
index 892f34049..91111f3eb 100644
--- a/krebs/3modules/repo-sync.nix
+++ b/krebs/3modules/repo-sync.nix
@@ -124,6 +124,7 @@ let
privateKeyFile = mkOption {
type = types.secret-file;
default = {
+ name = "repo-sync-key";
path = "${cfg.stateDir}/ssh.priv";
owner = cfg.user;
source-path = toString <secrets> + "/repo-sync.ssh.key";
@@ -170,7 +171,7 @@ let
config.krebs.secret.files.repo-sync-key.service
"network.target"
];
- requires = [
+ partOf = [
config.krebs.secret.files.repo-sync-key.service
];
diff --git a/krebs/3modules/secret.nix b/krebs/3modules/secret.nix
index 672c503b0..bf2c62cc9 100644
--- a/krebs/3modules/secret.nix
+++ b/krebs/3modules/secret.nix
@@ -1,4 +1,5 @@
-{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }: let
cfg = config.krebs.secret;
in {
options.krebs.secret = {
@@ -8,32 +9,43 @@ in {
};
};
config = lib.mkIf (cfg.files != {}) {
- systemd.services.secret = let
- # TODO fail if two files have the same path but differ otherwise
- files = unique (map (flip removeAttrs ["_module"])
- (attrValues cfg.files));
- in {
- serviceConfig = {
- Type = "oneshot";
- RemainAfterExit = "yes";
- SyslogIdentifier = "secret";
- ExecStart = pkgs.writeDash "install-secret-files" ''
- exit_code=0
- ${concatMapStringsSep "\n" (file: ''
- ${pkgs.coreutils}/bin/install \
- -D \
- --compare \
- --verbose \
- --mode=${shell.escape file.mode} \
- --owner=${shell.escape file.owner.name} \
- --group=${shell.escape file.group-name} \
- ${shell.escape file.source-path} \
- ${shell.escape file.path} \
- || exit_code=1
- '') files}
- exit $exit_code
- '';
- };
- };
+ systemd.paths =
+ mapAttrs'
+ (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ pathConfig.PathChanged = file.source-path;
+ })
+ cfg.files;
+ systemd.services =
+ mapAttrs'
+ (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ serviceConfig = {
+ Type = "oneshot";
+ ExecStart = "${pkgs.systemd}/bin/systemctl restart ${file.service}";
+ };
+ })
+ cfg.files
+ //
+ mapAttrs'
+ (name: file: nameValuePair "secret-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ serviceConfig = {
+ Type = "oneshot";
+ RemainAfterExit = "yes";
+ ExecStart = toString [
+ "${pkgs.coreutils}/bin/install"
+ "-D"
+ "--compare"
+ "--verbose"
+ "--mode=${file.mode}"
+ "--owner=${file.owner.name}"
+ "--group=${file.group-name}"
+ file.source-path
+ file.path
+ ];
+ };
+ })
+ cfg.files;
};
}
diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix
index 0be16d8f6..1fca7de5c 100644
--- a/krebs/3modules/tinc.nix
+++ b/krebs/3modules/tinc.nix
@@ -158,6 +158,7 @@ let
privkey = mkOption {
type = types.secret-file;
default = {
+ name = "${tinc.config.netname}.rsa_key.priv";
path = "${tinc.config.user.home}/tinc.rsa_key.priv";
owner = tinc.config.user;
source-path = toString <secrets> + "/${tinc.config.netname}.rsa_key.priv";
@@ -223,7 +224,7 @@ let
config.krebs.secret.files."${netname}.rsa_key.priv".service
"network.target"
];
- requires = [
+ partOf = [
config.krebs.secret.files."${netname}.rsa_key.priv".service
];
wantedBy = [ "multi-user.target" ];