summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--krebs/3modules/exim-smarthost.nix3
-rw-r--r--krebs/3modules/repo-sync.nix3
-rw-r--r--krebs/3modules/secret.nix68
-rw-r--r--krebs/3modules/tinc.nix3
-rw-r--r--lass/2configs/binary-cache/server.nix2
-rw-r--r--lass/2configs/websites/sqlBackup.nix2
-rw-r--r--lass/3modules/ejabberd/default.nix4
-rw-r--r--lib/default.nix3
-rw-r--r--lib/types.nix6
-rw-r--r--makefu/2configs/binary-cache/server.nix2
-rw-r--r--makefu/3modules/netdata.nix2
-rw-r--r--tv/2configs/binary-cache/default.nix2
-rw-r--r--tv/3modules/charybdis/default.nix4
-rw-r--r--tv/3modules/ejabberd/default.nix4
-rw-r--r--tv/3modules/x0vncserver.nix1
15 files changed, 67 insertions, 42 deletions
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index 2a97f9d6e..c5969caac 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -26,6 +26,7 @@ let
private_key = mkOption {
type = types.secret-file;
default = {
+ name = "exim.dkim_private_key/${config.domain}";
path = "/run/krebs.secret/${config.domain}.dkim_private_key";
owner.name = "exim";
source-path = toString <secrets> + "/${config.domain}.dkim.priv";
@@ -118,7 +119,7 @@ let
after = flip map cfg.dkim (dkim:
config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
);
- requires = flip map cfg.dkim (dkim:
+ partOf = flip map cfg.dkim (dkim:
config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
);
};
diff --git a/krebs/3modules/repo-sync.nix b/krebs/3modules/repo-sync.nix
index 892f34049..91111f3eb 100644
--- a/krebs/3modules/repo-sync.nix
+++ b/krebs/3modules/repo-sync.nix
@@ -124,6 +124,7 @@ let
privateKeyFile = mkOption {
type = types.secret-file;
default = {
+ name = "repo-sync-key";
path = "${cfg.stateDir}/ssh.priv";
owner = cfg.user;
source-path = toString <secrets> + "/repo-sync.ssh.key";
@@ -170,7 +171,7 @@ let
config.krebs.secret.files.repo-sync-key.service
"network.target"
];
- requires = [
+ partOf = [
config.krebs.secret.files.repo-sync-key.service
];
diff --git a/krebs/3modules/secret.nix b/krebs/3modules/secret.nix
index 672c503b0..bf2c62cc9 100644
--- a/krebs/3modules/secret.nix
+++ b/krebs/3modules/secret.nix
@@ -1,4 +1,5 @@
-{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }: let
cfg = config.krebs.secret;
in {
options.krebs.secret = {
@@ -8,32 +9,43 @@ in {
};
};
config = lib.mkIf (cfg.files != {}) {
- systemd.services.secret = let
- # TODO fail if two files have the same path but differ otherwise
- files = unique (map (flip removeAttrs ["_module"])
- (attrValues cfg.files));
- in {
- serviceConfig = {
- Type = "oneshot";
- RemainAfterExit = "yes";
- SyslogIdentifier = "secret";
- ExecStart = pkgs.writeDash "install-secret-files" ''
- exit_code=0
- ${concatMapStringsSep "\n" (file: ''
- ${pkgs.coreutils}/bin/install \
- -D \
- --compare \
- --verbose \
- --mode=${shell.escape file.mode} \
- --owner=${shell.escape file.owner.name} \
- --group=${shell.escape file.group-name} \
- ${shell.escape file.source-path} \
- ${shell.escape file.path} \
- || exit_code=1
- '') files}
- exit $exit_code
- '';
- };
- };
+ systemd.paths =
+ mapAttrs'
+ (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ pathConfig.PathChanged = file.source-path;
+ })
+ cfg.files;
+ systemd.services =
+ mapAttrs'
+ (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ serviceConfig = {
+ Type = "oneshot";
+ ExecStart = "${pkgs.systemd}/bin/systemctl restart ${file.service}";
+ };
+ })
+ cfg.files
+ //
+ mapAttrs'
+ (name: file: nameValuePair "secret-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ serviceConfig = {
+ Type = "oneshot";
+ RemainAfterExit = "yes";
+ ExecStart = toString [
+ "${pkgs.coreutils}/bin/install"
+ "-D"
+ "--compare"
+ "--verbose"
+ "--mode=${file.mode}"
+ "--owner=${file.owner.name}"
+ "--group=${file.group-name}"
+ file.source-path
+ file.path
+ ];
+ };
+ })
+ cfg.files;
};
}
diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix
index 0be16d8f6..1fca7de5c 100644
--- a/krebs/3modules/tinc.nix
+++ b/krebs/3modules/tinc.nix
@@ -158,6 +158,7 @@ let
privkey = mkOption {
type = types.secret-file;
default = {
+ name = "${tinc.config.netname}.rsa_key.priv";
path = "${tinc.config.user.home}/tinc.rsa_key.priv";
owner = tinc.config.user;
source-path = toString <secrets> + "/${tinc.config.netname}.rsa_key.priv";
@@ -223,7 +224,7 @@ let
config.krebs.secret.files."${netname}.rsa_key.priv".service
"network.target"
];
- requires = [
+ partOf = [
config.krebs.secret.files."${netname}.rsa_key.priv".service
];
wantedBy = [ "multi-user.target" ];
diff --git a/lass/2configs/binary-cache/server.nix b/lass/2configs/binary-cache/server.nix
index fbaf16a3c..9b91035a8 100644
--- a/lass/2configs/binary-cache/server.nix
+++ b/lass/2configs/binary-cache/server.nix
@@ -12,7 +12,7 @@
after = [
config.krebs.secret.files.nix-serve-key.service
];
- requires = [
+ partOf = [
config.krebs.secret.files.nix-serve-key.service
];
};
diff --git a/lass/2configs/websites/sqlBackup.nix b/lass/2configs/websites/sqlBackup.nix
index 72d7c7b9a..c9783bece 100644
--- a/lass/2configs/websites/sqlBackup.nix
+++ b/lass/2configs/websites/sqlBackup.nix
@@ -17,7 +17,7 @@
after = [
config.krebs.secret.files.mysql_rootPassword.service
];
- requires = [
+ partOf = [
config.krebs.secret.files.mysql_rootPassword.service
];
};
diff --git a/lass/3modules/ejabberd/default.nix b/lass/3modules/ejabberd/default.nix
index 9642c64c9..20a38d572 100644
--- a/lass/3modules/ejabberd/default.nix
+++ b/lass/3modules/ejabberd/default.nix
@@ -17,6 +17,7 @@ in {
certfile = mkOption {
type = types.secret-file;
default = {
+ name = "ejabberd-certfile";
path = "${cfg.user.home}/ejabberd.pem";
owner = cfg.user;
source-path = "/var/lib/acme/lassul.us/full.pem";
@@ -25,6 +26,7 @@ in {
dhfile = mkOption {
type = types.secret-file;
default = {
+ name = "ejabberd-dhfile";
path = "${cfg.user.home}/dhparams.pem";
owner = cfg.user;
source-path = "/dev/null";
@@ -79,7 +81,7 @@ in {
config.krebs.secret.files.ejabberd-s2s_certfile.service
"network.target"
];
- requires = [
+ partOf = [
config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
];
diff --git a/lib/default.nix b/lib/default.nix
index 5a948bbf3..f02959bba 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -8,6 +8,9 @@ let
krebs = import ./krebs lib;
krops = import ../submodules/krops/lib;
shell = import ./shell.nix { inherit lib; };
+ systemd = {
+ encodeName = replaceChars ["/"] ["\\x2f"];
+ };
types = nixpkgs-lib.types // import ./types.nix { inherit lib; };
xml = import ./xml.nix { inherit lib; };
diff --git a/lib/types.nix b/lib/types.nix
index 66b01fd12..1eb4d947c 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -238,7 +238,7 @@ rec {
secret-file = submodule ({ config, ... }: {
options = {
name = mkOption {
- type = filename;
+ type = pathname;
default = config._module.args.name;
};
path = mkOption {
@@ -257,8 +257,8 @@ rec {
default = "root";
};
service = mkOption {
- type = filename;
- default = "secret.service";
+ type = systemd.unit-name;
+ default = "secret-${lib.systemd.encodeName config.name}.service";
};
source-path = mkOption {
type = str;
diff --git a/makefu/2configs/binary-cache/server.nix b/makefu/2configs/binary-cache/server.nix
index 3fc174a1b..1d729b9bb 100644
--- a/makefu/2configs/binary-cache/server.nix
+++ b/makefu/2configs/binary-cache/server.nix
@@ -12,7 +12,7 @@
after = [
config.krebs.secret.files.nix-serve-key.service
];
- requires = [
+ partOf = [
config.krebs.secret.files.nix-serve-key.service
];
};
diff --git a/makefu/3modules/netdata.nix b/makefu/3modules/netdata.nix
index a3c789eb2..bfa6f404c 100644
--- a/makefu/3modules/netdata.nix
+++ b/makefu/3modules/netdata.nix
@@ -74,7 +74,7 @@ in
after = [
config.krebs.secret.files.netdata-stream.service
];
- requires = [
+ partOf = [
config.krebs.secret.files.netdata-stream.service
];
};
diff --git a/tv/2configs/binary-cache/default.nix b/tv/2configs/binary-cache/default.nix
index 970f705f0..866434cb5 100644
--- a/tv/2configs/binary-cache/default.nix
+++ b/tv/2configs/binary-cache/default.nix
@@ -12,7 +12,7 @@
after = [
config.krebs.secret.files.binary-cache-seckey.service
];
- requires = [
+ partOf = [
config.krebs.secret.files.binary-cache-seckey.service
];
};
diff --git a/tv/3modules/charybdis/default.nix b/tv/3modules/charybdis/default.nix
index 3809da404..a0638e1eb 100644
--- a/tv/3modules/charybdis/default.nix
+++ b/tv/3modules/charybdis/default.nix
@@ -17,6 +17,7 @@ in {
ssl_dh_params = mkOption {
type = types.secret-file;
default = {
+ name = "charybdis-ssl_dh_params";
path = "${cfg.user.home}/dh.pem";
owner = cfg.user;
source-path = toString <secrets> + "/charybdis.dh.pem";
@@ -25,6 +26,7 @@ in {
ssl_private_key = mkOption {
type = types.secret-file;
default = {
+ name = "charybdis-ssl_private_key";
path = "${cfg.user.home}/ssl.key.pem";
owner = cfg.user;
source-path = toString <secrets> + "/charybdis.key.pem";
@@ -56,7 +58,7 @@ in {
config.krebs.secret.files.charybdis-ssl_private_key.service
"network-online.target"
];
- requires = [
+ partOf = [
config.krebs.secret.files.charybdis-ssl_dh_params.service
config.krebs.secret.files.charybdis-ssl_private_key.service
];
diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix
index b995c145a..aaf262fa1 100644
--- a/tv/3modules/ejabberd/default.nix
+++ b/tv/3modules/ejabberd/default.nix
@@ -18,6 +18,7 @@ in {
certfile = mkOption {
type = types.secret-file;
default = {
+ name = "ejabberd-certfile";
path = "${cfg.user.home}/ejabberd.pem";
owner = cfg.user;
source-path = toString <secrets> + "/ejabberd.pem";
@@ -26,6 +27,7 @@ in {
dhfile = mkOption {
type = types.secret-file;
default = {
+ name = "ejabberd-dhfile";
path = "${cfg.user.home}/dhparams.pem";
owner = cfg.user;
source-path = "/dev/null";
@@ -100,7 +102,7 @@ in {
config.krebs.secret.files.ejabberd-s2s_certfile.service
"network.target"
];
- requires = [
+ partOf = [
config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
];
diff --git a/tv/3modules/x0vncserver.nix b/tv/3modules/x0vncserver.nix
index 8b9cfa89d..ba79c4a49 100644
--- a/tv/3modules/x0vncserver.nix
+++ b/tv/3modules/x0vncserver.nix
@@ -12,6 +12,7 @@ in {
enable = mkEnableOption "tv.x0vncserver";
pwfile = mkOption {
default = {
+ name = "x0vncserver-pwfile";
owner = cfg.user;
path = "${cfg.user.home}/.vncpasswd";
source-path = toString <secrets> + "/vncpasswd";
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-31 19:27:03 +0000