krebs.secret: restart units on secret change

4 files changed, 46 insertions, 31 deletions

diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index 2a97f9d6e..c5969caac 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -26,6 +26,7 @@ let
           private_key = mkOption {
             type = types.secret-file;
             default = {
+              name = "exim.dkim_private_key/${config.domain}";
               path = "/run/krebs.secret/${config.domain}.dkim_private_key";
               owner.name = "exim";
               source-path = toString <secrets> + "/${config.domain}.dkim.priv";
@@ -118,7 +119,7 @@ let
         after = flip map cfg.dkim (dkim:
           config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
         );
-        requires = flip map cfg.dkim (dkim:
+        partOf = flip map cfg.dkim (dkim:
           config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
         );
       };
diff --git a/krebs/3modules/repo-sync.nix b/krebs/3modules/repo-sync.nix
index 892f34049..91111f3eb 100644
--- a/krebs/3modules/repo-sync.nix
+++ b/krebs/3modules/repo-sync.nix
@@ -124,6 +124,7 @@ let
     privateKeyFile = mkOption {
       type = types.secret-file;
       default = {
+        name = "repo-sync-key";
         path = "${cfg.stateDir}/ssh.priv";
         owner = cfg.user;
         source-path = toString <secrets> + "/repo-sync.ssh.key";
@@ -170,7 +171,7 @@ let
           config.krebs.secret.files.repo-sync-key.service
           "network.target"
         ];
-        requires = [
+        partOf = [
           config.krebs.secret.files.repo-sync-key.service
         ];
 
diff --git a/krebs/3modules/secret.nix b/krebs/3modules/secret.nix
index 672c503b0..bf2c62cc9 100644
--- a/krebs/3modules/secret.nix
+++ b/krebs/3modules/secret.nix
@@ -1,4 +1,5 @@
-{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }: let
   cfg = config.krebs.secret;
 in {
   options.krebs.secret = {
@@ -8,32 +9,43 @@ in {
     };
   };
   config = lib.mkIf (cfg.files != {}) {
-    systemd.services.secret = let
-      # TODO fail if two files have the same path but differ otherwise
-      files = unique (map (flip removeAttrs ["_module"])
-                          (attrValues cfg.files));
-    in {
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = "yes";
-        SyslogIdentifier = "secret";
-        ExecStart = pkgs.writeDash "install-secret-files" ''
-          exit_code=0
-          ${concatMapStringsSep "\n" (file: ''
-            ${pkgs.coreutils}/bin/install \
-                  -D \
-                  --compare \
-                  --verbose \
-                  --mode=${shell.escape file.mode} \
-                  --owner=${shell.escape file.owner.name} \
-                  --group=${shell.escape file.group-name} \
-                  ${shell.escape file.source-path} \
-                  ${shell.escape file.path} \
-                || exit_code=1
-          '') files}
-          exit $exit_code
-        '';
-      };
-    };
+    systemd.paths =
+      mapAttrs'
+        (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+          wantedBy = ["multi-user.target"];
+          pathConfig.PathChanged = file.source-path;
+        })
+        cfg.files;
+    systemd.services =
+      mapAttrs'
+        (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+          wantedBy = ["multi-user.target"];
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = "${pkgs.systemd}/bin/systemctl restart ${file.service}";
+          };
+        })
+        cfg.files
+      //
+      mapAttrs'
+        (name: file: nameValuePair "secret-${systemd.encodeName name}" {
+          wantedBy = ["multi-user.target"];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = "yes";
+            ExecStart = toString [
+              "${pkgs.coreutils}/bin/install"
+              "-D"
+              "--compare"
+              "--verbose"
+              "--mode=${file.mode}"
+              "--owner=${file.owner.name}"
+              "--group=${file.group-name}"
+              file.source-path
+              file.path
+            ];
+          };
+        })
+        cfg.files;
   };
 }
diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix
index 0be16d8f6..1fca7de5c 100644
--- a/krebs/3modules/tinc.nix
+++ b/krebs/3modules/tinc.nix
@@ -158,6 +158,7 @@ let
         privkey = mkOption {
           type = types.secret-file;
           default = {
+            name = "${tinc.config.netname}.rsa_key.priv";
             path = "${tinc.config.user.home}/tinc.rsa_key.priv";
             owner = tinc.config.user;
             source-path = toString <secrets> + "/${tinc.config.netname}.rsa_key.priv";
@@ -223,7 +224,7 @@ let
           config.krebs.secret.files."${netname}.rsa_key.priv".service
           "network.target"
         ];
-        requires = [
+        partOf = [
           config.krebs.secret.files."${netname}.rsa_key.priv".service
         ];
         wantedBy = [ "multi-user.target" ];