summaryrefslogtreecommitdiffstats
path: root/tv
diff options
context:
space:
mode:
authorlassulus <lassulus@lassul.us>2020-08-06 23:24:29 +0200
committerlassulus <lassulus@lassul.us>2020-08-06 23:24:29 +0200
commite0e91cfd74c9ce5d3f9ce9c2e2efab322a00f960 (patch)
treef17565a1d7bc496b0b439ff45010f3f9c91c6d4f /tv
parent04d9ff2dcdc039518391fcb41ffbb256e2f4ba23 (diff)
parent42df7da046f46efaca0cb0243a6de3aff599c8aa (diff)
Merge remote-tracking branch 'ni/master'
Diffstat (limited to 'tv')
-rw-r--r--tv/2configs/binary-cache/default.nix8
-rw-r--r--tv/3modules/charybdis/default.nix13
-rw-r--r--tv/3modules/ejabberd/default.nix13
-rw-r--r--tv/3modules/x0vncserver.nix13
4 files changed, 39 insertions, 8 deletions
diff --git a/tv/2configs/binary-cache/default.nix b/tv/2configs/binary-cache/default.nix
index 39c944b1a..866434cb5 100644
--- a/tv/2configs/binary-cache/default.nix
+++ b/tv/2configs/binary-cache/default.nix
@@ -9,8 +9,12 @@
};
systemd.services.nix-serve = {
- requires = ["secret.service"];
- after = ["secret.service"];
+ after = [
+ config.krebs.secret.files.binary-cache-seckey.service
+ ];
+ partOf = [
+ config.krebs.secret.files.binary-cache-seckey.service
+ ];
};
krebs.secret.files.binary-cache-seckey = {
diff --git a/tv/3modules/charybdis/default.nix b/tv/3modules/charybdis/default.nix
index 62a7037e3..a0638e1eb 100644
--- a/tv/3modules/charybdis/default.nix
+++ b/tv/3modules/charybdis/default.nix
@@ -17,6 +17,7 @@ in {
ssl_dh_params = mkOption {
type = types.secret-file;
default = {
+ name = "charybdis-ssl_dh_params";
path = "${cfg.user.home}/dh.pem";
owner = cfg.user;
source-path = toString <secrets> + "/charybdis.dh.pem";
@@ -25,6 +26,7 @@ in {
ssl_private_key = mkOption {
type = types.secret-file;
default = {
+ name = "charybdis-ssl_private_key";
path = "${cfg.user.home}/ssl.key.pem";
owner = cfg.user;
source-path = toString <secrets> + "/charybdis.key.pem";
@@ -51,8 +53,15 @@ in {
systemd.services.charybdis = {
wantedBy = [ "multi-user.target" ];
- requires = [ "secret.service" ];
- after = [ "network-online.target" "secret.service" ];
+ after = [
+ config.krebs.secret.files.charybdis-ssl_dh_params.service
+ config.krebs.secret.files.charybdis-ssl_private_key.service
+ "network-online.target"
+ ];
+ partOf = [
+ config.krebs.secret.files.charybdis-ssl_dh_params.service
+ config.krebs.secret.files.charybdis-ssl_private_key.service
+ ];
environment = {
BANDB_DBPATH = "${cfg.user.home}/ban.db";
};
diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix
index f16dfac86..aaf262fa1 100644
--- a/tv/3modules/ejabberd/default.nix
+++ b/tv/3modules/ejabberd/default.nix
@@ -18,6 +18,7 @@ in {
certfile = mkOption {
type = types.secret-file;
default = {
+ name = "ejabberd-certfile";
path = "${cfg.user.home}/ejabberd.pem";
owner = cfg.user;
source-path = toString <secrets> + "/ejabberd.pem";
@@ -26,6 +27,7 @@ in {
dhfile = mkOption {
type = types.secret-file;
default = {
+ name = "ejabberd-dhfile";
path = "${cfg.user.home}/dhparams.pem";
owner = cfg.user;
source-path = "/dev/null";
@@ -95,8 +97,15 @@ in {
systemd.services.ejabberd = {
wantedBy = [ "multi-user.target" ];
- requires = [ "secret.service" ];
- after = [ "network.target" "secret.service" ];
+ after = [
+ config.krebs.secret.files.ejabberd-certfile.service
+ config.krebs.secret.files.ejabberd-s2s_certfile.service
+ "network.target"
+ ];
+ partOf = [
+ config.krebs.secret.files.ejabberd-certfile.service
+ config.krebs.secret.files.ejabberd-s2s_certfile.service
+ ];
serviceConfig = {
ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground";
diff --git a/tv/3modules/x0vncserver.nix b/tv/3modules/x0vncserver.nix
index 44fed590d..ba79c4a49 100644
--- a/tv/3modules/x0vncserver.nix
+++ b/tv/3modules/x0vncserver.nix
@@ -12,6 +12,7 @@ in {
enable = mkEnableOption "tv.x0vncserver";
pwfile = mkOption {
default = {
+ name = "x0vncserver-pwfile";
owner = cfg.user;
path = "${cfg.user.home}/.vncpasswd";
source-path = toString <secrets> + "/vncpasswd";
@@ -36,8 +37,16 @@ in {
x0vncserver-pwfile = cfg.pwfile;
};
systemd.services.x0vncserver = {
- after = [ "graphical.target" "secret.service" ];
- requires = [ "graphical.target" "secret.service" ];
+ after = [
+ config.krebs.secret.files.x0vncserver-pwfile.service
+ "graphical.target"
+ ];
+ partOf = [
+ config.krebs.secret.files.x0vncserver-pwfile.service
+ ];
+ requires = [
+ "graphical.target"
+ ];
serviceConfig = {
ExecStart = "${pkgs.tigervnc}/bin/x0vncserver ${toString [
"-display ${cfg.display}"