summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--jeschli/5pkgs/firefox/firefox-with-config.nix3
-rw-r--r--krebs/3modules/exim-smarthost.nix9
-rw-r--r--krebs/3modules/konsens.nix2
-rw-r--r--krebs/3modules/repo-sync.nix9
-rw-r--r--krebs/3modules/secret.nix68
-rw-r--r--krebs/3modules/tinc.nix10
-rw-r--r--lass/2configs/binary-cache/server.nix8
-rw-r--r--lass/2configs/websites/sqlBackup.nix8
-rw-r--r--lass/3modules/ejabberd/default.nix13
-rw-r--r--lib/default.nix3
-rw-r--r--lib/types.nix14
-rw-r--r--makefu/2configs/binary-cache/server.nix8
-rw-r--r--makefu/3modules/netdata.nix8
-rw-r--r--tv/2configs/binary-cache/default.nix8
-rw-r--r--tv/3modules/charybdis/default.nix13
-rw-r--r--tv/3modules/ejabberd/default.nix13
-rw-r--r--tv/3modules/x0vncserver.nix13
17 files changed, 155 insertions, 55 deletions
diff --git a/jeschli/5pkgs/firefox/firefox-with-config.nix b/jeschli/5pkgs/firefox/firefox-with-config.nix
index 9be6250d7..fc22c434e 100644
--- a/jeschli/5pkgs/firefox/firefox-with-config.nix
+++ b/jeschli/5pkgs/firefox/firefox-with-config.nix
@@ -5,7 +5,7 @@
, MPlayerPlugin, ffmpeg, xorg, libpulseaudio, libcanberra-gtk2
, jrePlugin, icedtea_web
, bluejeans, djview4, adobe-reader
-, google_talk_plugin, fribid, gnome3/*.gnome-shell*/
+, fribid, gnome3/*.gnome-shell*/
, esteidfirefoxplugin ? ""
, browserpass, chrome-gnome-shell, uget-integrator, plasma-browser-integration, bukubrow
, udev
@@ -82,7 +82,6 @@ let
++ lib.optional (cfg.enableMPlayer or false) (MPlayerPlugin browser)
++ lib.optional (supportsJDK && jre && jrePlugin ? mozillaPlugin) jrePlugin
++ lib.optional icedtea icedtea_web
- ++ lib.optional (cfg.enableGoogleTalkPlugin or false) google_talk_plugin
++ lib.optional (cfg.enableFriBIDPlugin or false) fribid
++ lib.optional (cfg.enableGnomeExtensions or false) gnome3.gnome-shell
++ lib.optional (cfg.enableBluejeans or false) bluejeans
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index e988fb563..c5969caac 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -26,6 +26,7 @@ let
private_key = mkOption {
type = types.secret-file;
default = {
+ name = "exim.dkim_private_key/${config.domain}";
path = "/run/krebs.secret/${config.domain}.dkim_private_key";
owner.name = "exim";
source-path = toString <secrets> + "/${config.domain}.dkim.priv";
@@ -115,8 +116,12 @@ let
}));
systemd.services = mkIf (cfg.dkim != []) {
exim = {
- after = [ "secret.service" ];
- requires = [ "secret.service" ];
+ after = flip map cfg.dkim (dkim:
+ config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
+ );
+ partOf = flip map cfg.dkim (dkim:
+ config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
+ );
};
};
krebs.exim = {
diff --git a/krebs/3modules/konsens.nix b/krebs/3modules/konsens.nix
index 74895a971..81486810b 100644
--- a/krebs/3modules/konsens.nix
+++ b/krebs/3modules/konsens.nix
@@ -56,7 +56,7 @@ let
systemd.services = mapAttrs' (name: repo:
nameValuePair "konsens-${name}" {
- after = [ "network.target" "secret.service" ];
+ after = [ "network.target" ];
path = [ pkgs.git ];
restartIfChanged = false;
serviceConfig = {
diff --git a/krebs/3modules/repo-sync.nix b/krebs/3modules/repo-sync.nix
index 45d9d81c3..91111f3eb 100644
--- a/krebs/3modules/repo-sync.nix
+++ b/krebs/3modules/repo-sync.nix
@@ -124,6 +124,7 @@ let
privateKeyFile = mkOption {
type = types.secret-file;
default = {
+ name = "repo-sync-key";
path = "${cfg.stateDir}/ssh.priv";
owner = cfg.user;
source-path = toString <secrets> + "/repo-sync.ssh.key";
@@ -166,7 +167,13 @@ let
});
in nameValuePair "repo-sync-${name}" {
description = "repo-sync";
- after = [ "network.target" "secret.service" ];
+ after = [
+ config.krebs.secret.files.repo-sync-key.service
+ "network.target"
+ ];
+ partOf = [
+ config.krebs.secret.files.repo-sync-key.service
+ ];
environment = {
GIT_SSH_COMMAND = "${pkgs.openssh}/bin/ssh -i ${cfg.stateDir}/ssh.priv";
diff --git a/krebs/3modules/secret.nix b/krebs/3modules/secret.nix
index 672c503b0..bf2c62cc9 100644
--- a/krebs/3modules/secret.nix
+++ b/krebs/3modules/secret.nix
@@ -1,4 +1,5 @@
-{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }: let
cfg = config.krebs.secret;
in {
options.krebs.secret = {
@@ -8,32 +9,43 @@ in {
};
};
config = lib.mkIf (cfg.files != {}) {
- systemd.services.secret = let
- # TODO fail if two files have the same path but differ otherwise
- files = unique (map (flip removeAttrs ["_module"])
- (attrValues cfg.files));
- in {
- serviceConfig = {
- Type = "oneshot";
- RemainAfterExit = "yes";
- SyslogIdentifier = "secret";
- ExecStart = pkgs.writeDash "install-secret-files" ''
- exit_code=0
- ${concatMapStringsSep "\n" (file: ''
- ${pkgs.coreutils}/bin/install \
- -D \
- --compare \
- --verbose \
- --mode=${shell.escape file.mode} \
- --owner=${shell.escape file.owner.name} \
- --group=${shell.escape file.group-name} \
- ${shell.escape file.source-path} \
- ${shell.escape file.path} \
- || exit_code=1
- '') files}
- exit $exit_code
- '';
- };
- };
+ systemd.paths =
+ mapAttrs'
+ (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ pathConfig.PathChanged = file.source-path;
+ })
+ cfg.files;
+ systemd.services =
+ mapAttrs'
+ (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ serviceConfig = {
+ Type = "oneshot";
+ ExecStart = "${pkgs.systemd}/bin/systemctl restart ${file.service}";
+ };
+ })
+ cfg.files
+ //
+ mapAttrs'
+ (name: file: nameValuePair "secret-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ serviceConfig = {
+ Type = "oneshot";
+ RemainAfterExit = "yes";
+ ExecStart = toString [
+ "${pkgs.coreutils}/bin/install"
+ "-D"
+ "--compare"
+ "--verbose"
+ "--mode=${file.mode}"
+ "--owner=${file.owner.name}"
+ "--group=${file.group-name}"
+ file.source-path
+ file.path
+ ];
+ };
+ })
+ cfg.files;
};
}
diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix
index 8b6e959d4..1fca7de5c 100644
--- a/krebs/3modules/tinc.nix
+++ b/krebs/3modules/tinc.nix
@@ -158,6 +158,7 @@ let
privkey = mkOption {
type = types.secret-file;
default = {
+ name = "${tinc.config.netname}.rsa_key.priv";
path = "${tinc.config.user.home}/tinc.rsa_key.priv";
owner = tinc.config.user;
source-path = toString <secrets> + "/${tinc.config.netname}.rsa_key.priv";
@@ -219,9 +220,14 @@ let
iproute = cfg.iproutePackage;
in {
description = "Tinc daemon for ${netname}";
- after = [ "network.target" ];
+ after = [
+ config.krebs.secret.files."${netname}.rsa_key.priv".service
+ "network.target"
+ ];
+ partOf = [
+ config.krebs.secret.files."${netname}.rsa_key.priv".service
+ ];
wantedBy = [ "multi-user.target" ];
- requires = [ "secret.service" ];
path = [ tinc iproute ];
serviceConfig = rec {
Restart = "always";
diff --git a/lass/2configs/binary-cache/server.nix b/lass/2configs/binary-cache/server.nix
index d3775b5df..9b91035a8 100644
--- a/lass/2configs/binary-cache/server.nix
+++ b/lass/2configs/binary-cache/server.nix
@@ -9,8 +9,12 @@
};
systemd.services.nix-serve = {
- requires = ["secret.service"];
- after = ["secret.service"];
+ after = [
+ config.krebs.secret.files.nix-serve-key.service
+ ];
+ partOf = [
+ config.krebs.secret.files.nix-serve-key.service
+ ];
};
krebs.secret.files.nix-serve-key = {
path = "/run/secret/nix-serve.key";
diff --git a/lass/2configs/websites/sqlBackup.nix b/lass/2configs/websites/sqlBackup.nix
index 10a6e4643..c9783bece 100644
--- a/lass/2configs/websites/sqlBackup.nix
+++ b/lass/2configs/websites/sqlBackup.nix
@@ -14,8 +14,12 @@
};
systemd.services.mysql = {
- requires = [ "secret.service" ];
- after = [ "secret.service" ];
+ after = [
+ config.krebs.secret.files.mysql_rootPassword.service
+ ];
+ partOf = [
+ config.krebs.secret.files.mysql_rootPassword.service
+ ];
};
lass.mysqlBackup = {
diff --git a/lass/3modules/ejabberd/default.nix b/lass/3modules/ejabberd/default.nix
index 4838a9093..20a38d572 100644
--- a/lass/3modules/ejabberd/default.nix
+++ b/lass/3modules/ejabberd/default.nix
@@ -17,6 +17,7 @@ in {
certfile = mkOption {
type = types.secret-file;
default = {
+ name = "ejabberd-certfile";
path = "${cfg.user.home}/ejabberd.pem";
owner = cfg.user;
source-path = "/var/lib/acme/lassul.us/full.pem";
@@ -25,6 +26,7 @@ in {
dhfile = mkOption {
type = types.secret-file;
default = {
+ name = "ejabberd-dhfile";
path = "${cfg.user.home}/dhparams.pem";
owner = cfg.user;
source-path = "/dev/null";
@@ -74,8 +76,15 @@ in {
systemd.services.ejabberd = {
wantedBy = [ "multi-user.target" ];
- requires = [ "secret.service" ];
- after = [ "network.target" "secret.service" ];
+ after = [
+ config.krebs.secret.files.ejabberd-certfile.service
+ config.krebs.secret.files.ejabberd-s2s_certfile.service
+ "network.target"
+ ];
+ partOf = [
+ config.krebs.secret.files.ejabberd-certfile.service
+ config.krebs.secret.files.ejabberd-s2s_certfile.service
+ ];
serviceConfig = {
ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
ExecStart = "${cfg.pkgs.ejabberdctl}/bin/ejabberdctl foreground";
diff --git a/lib/default.nix b/lib/default.nix
index 5a948bbf3..f02959bba 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -8,6 +8,9 @@ let
krebs = import ./krebs lib;
krops = import ../submodules/krops/lib;
shell = import ./shell.nix { inherit lib; };
+ systemd = {
+ encodeName = replaceChars ["/"] ["\\x2f"];
+ };
types = nixpkgs-lib.types // import ./types.nix { inherit lib; };
xml = import ./xml.nix { inherit lib; };
diff --git a/lib/types.nix b/lib/types.nix
index 16ccb145e..1eb4d947c 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -238,7 +238,7 @@ rec {
secret-file = submodule ({ config, ... }: {
options = {
name = mkOption {
- type = filename;
+ type = pathname;
default = config._module.args.name;
};
path = mkOption {
@@ -256,6 +256,10 @@ rec {
type = str;
default = "root";
};
+ service = mkOption {
+ type = systemd.unit-name;
+ default = "secret-${lib.systemd.encodeName config.name}.service";
+ };
source-path = mkOption {
type = str;
default = toString <secrets> + "/${config.name}";
@@ -526,6 +530,14 @@ rec {
merge = mergeOneOption;
};
+ systemd.unit-name = mkOptionType {
+ name = "systemd unit name";
+ check = x:
+ test "^[0-9A-Za-z:_.\\-]+@?\\.(service|socket|device|mount|automount|swap|target|path|timer|slice|scope)$" x &&
+ stringLength x <= 256;
+ merge = mergeOneOption;
+ };
+
# RFC952, B. Lexical grammar, <hname>
hostname = mkOptionType {
name = "hostname";
diff --git a/makefu/2configs/binary-cache/server.nix b/makefu/2configs/binary-cache/server.nix
index c8f68c84d..1d729b9bb 100644
--- a/makefu/2configs/binary-cache/server.nix
+++ b/makefu/2configs/binary-cache/server.nix
@@ -9,8 +9,12 @@
};
systemd.services.nix-serve = {
- requires = ["secret.service"];
- after = ["secret.service"];
+ after = [
+ config.krebs.secret.files.nix-serve-key.service
+ ];
+ partOf = [
+ config.krebs.secret.files.nix-serve-key.service
+ ];
};
krebs.secret.files.nix-serve-key = {
path = "/run/secret/nix-serve.key";
diff --git a/makefu/3modules/netdata.nix b/makefu/3modules/netdata.nix
index 3ed33643c..bfa6f404c 100644
--- a/makefu/3modules/netdata.nix
+++ b/makefu/3modules/netdata.nix
@@ -71,8 +71,12 @@ in
};
config = mkIf cfg.enable {
systemd.services.netdata = {
- requires = [ "secret.service" ];
- after = [ "secret.service" ];
+ after = [
+ config.krebs.secret.files.netdata-stream.service
+ ];
+ partOf = [
+ config.krebs.secret.files.netdata-stream.service
+ ];
};
krebs.secret.files.netdata-stream = {
path = "/run/secret/netdata-stream.conf";
diff --git a/tv/2configs/binary-cache/default.nix b/tv/2configs/binary-cache/default.nix
index 39c944b1a..866434cb5 100644
--- a/tv/2configs/binary-cache/default.nix
+++ b/tv/2configs/binary-cache/default.nix
@@ -9,8 +9,12 @@
};
systemd.services.nix-serve = {
- requires = ["secret.service"];
- after = ["secret.service"];
+ after = [
+ config.krebs.secret.files.binary-cache-seckey.service
+ ];
+ partOf = [
+ config.krebs.secret.files.binary-cache-seckey.service
+ ];
};
krebs.secret.files.binary-cache-seckey = {
diff --git a/tv/3modules/charybdis/default.nix b/tv/3modules/charybdis/default.nix
index 62a7037e3..a0638e1eb 100644
--- a/tv/3modules/charybdis/default.nix
+++ b/tv/3modules/charybdis/default.nix
@@ -17,6 +17,7 @@ in {
ssl_dh_params = mkOption {
type = types.secret-file;
default = {
+ name = "charybdis-ssl_dh_params";
path = "${cfg.user.home}/dh.pem";
owner = cfg.user;
source-path = toString <secrets> + "/charybdis.dh.pem";
@@ -25,6 +26,7 @@ in {
ssl_private_key = mkOption {
type = types.secret-file;
default = {
+ name = "charybdis-ssl_private_key";
path = "${cfg.user.home}/ssl.key.pem";
owner = cfg.user;
source-path = toString <secrets> + "/charybdis.key.pem";
@@ -51,8 +53,15 @@ in {
systemd.services.charybdis = {
wantedBy = [ "multi-user.target" ];
- requires = [ "secret.service" ];
- after = [ "network-online.target" "secret.service" ];
+ after = [
+ config.krebs.secret.files.charybdis-ssl_dh_params.service
+ config.krebs.secret.files.charybdis-ssl_private_key.service
+ "network-online.target"
+ ];
+ partOf = [
+ config.krebs.secret.files.charybdis-ssl_dh_params.service
+ config.krebs.secret.files.charybdis-ssl_private_key.service
+ ];
environment = {
BANDB_DBPATH = "${cfg.user.home}/ban.db";
};
diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix
index f16dfac86..aaf262fa1 100644
--- a/tv/3modules/ejabberd/default.nix
+++ b/tv/3modules/ejabberd/default.nix
@@ -18,6 +18,7 @@ in {
certfile = mkOption {
type = types.secret-file;
default = {
+ name = "ejabberd-certfile";
path = "${cfg.user.home}/ejabberd.pem";
owner = cfg.user;
source-path = toString <secrets> + "/ejabberd.pem";
@@ -26,6 +27,7 @@ in {
dhfile = mkOption {
type = types.secret-file;
default = {
+ name = "ejabberd-dhfile";
path = "${cfg.user.home}/dhparams.pem";
owner = cfg.user;
source-path = "/dev/null";
@@ -95,8 +97,15 @@ in {
systemd.services.ejabberd = {
wantedBy = [ "multi-user.target" ];
- requires = [ "secret.service" ];
- after = [ "network.target" "secret.service" ];
+ after = [
+ config.krebs.secret.files.ejabberd-certfile.service
+ config.krebs.secret.files.ejabberd-s2s_certfile.service
+ "network.target"
+ ];
+ partOf = [
+ config.krebs.secret.files.ejabberd-certfile.service
+ config.krebs.secret.files.ejabberd-s2s_certfile.service
+ ];
serviceConfig = {
ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground";
diff --git a/tv/3modules/x0vncserver.nix b/tv/3modules/x0vncserver.nix
index 44fed590d..ba79c4a49 100644
--- a/tv/3modules/x0vncserver.nix
+++ b/tv/3modules/x0vncserver.nix
@@ -12,6 +12,7 @@ in {
enable = mkEnableOption "tv.x0vncserver";
pwfile = mkOption {
default = {
+ name = "x0vncserver-pwfile";
owner = cfg.user;
path = "${cfg.user.home}/.vncpasswd";
source-path = toString <secrets> + "/vncpasswd";
@@ -36,8 +37,16 @@ in {
x0vncserver-pwfile = cfg.pwfile;
};
systemd.services.x0vncserver = {
- after = [ "graphical.target" "secret.service" ];
- requires = [ "graphical.target" "secret.service" ];
+ after = [
+ config.krebs.secret.files.x0vncserver-pwfile.service
+ "graphical.target"
+ ];
+ partOf = [
+ config.krebs.secret.files.x0vncserver-pwfile.service
+ ];
+ requires = [
+ "graphical.target"
+ ];
serviceConfig = {
ExecStart = "${pkgs.tigervnc}/bin/x0vncserver ${toString [
"-display ${cfg.display}"
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-30 04:44:45 +0000