Merge remote-tracking branch 'lass/master'

5 files changed, 40 insertions, 8 deletions

diff --git a/tv/2configs/binary-cache/default.nix b/tv/2configs/binary-cache/default.nix
index 39c944b1a..866434cb5 100644
--- a/tv/2configs/binary-cache/default.nix
+++ b/tv/2configs/binary-cache/default.nix
@@ -9,8 +9,12 @@
   };
 
   systemd.services.nix-serve = {
-    requires = ["secret.service"];
-    after = ["secret.service"];
+    after = [
+      config.krebs.secret.files.binary-cache-seckey.service
+    ];
+    partOf = [
+      config.krebs.secret.files.binary-cache-seckey.service
+    ];
   };
 
   krebs.secret.files.binary-cache-seckey = {
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 72c48da2c..4d27b0eac 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -36,6 +36,7 @@ with import <stockholm/lib>;
       };
     }
     {
+      i18n.defaultLocale = mkDefault "C.UTF-8";
       security.hideProcessInformation = true;
       security.sudo.extraConfig = ''
         Defaults env_keep+="SSH_CLIENT XMONAD_SPAWN_WORKSPACE"
diff --git a/tv/3modules/charybdis/default.nix b/tv/3modules/charybdis/default.nix
index 62a7037e3..a0638e1eb 100644
--- a/tv/3modules/charybdis/default.nix
+++ b/tv/3modules/charybdis/default.nix
@@ -17,6 +17,7 @@ in {
     ssl_dh_params = mkOption {
       type = types.secret-file;
       default = {
+        name = "charybdis-ssl_dh_params";
         path = "${cfg.user.home}/dh.pem";
         owner = cfg.user;
         source-path = toString <secrets> + "/charybdis.dh.pem";
@@ -25,6 +26,7 @@ in {
     ssl_private_key = mkOption {
       type = types.secret-file;
       default = {
+        name = "charybdis-ssl_private_key";
         path = "${cfg.user.home}/ssl.key.pem";
         owner = cfg.user;
         source-path = toString <secrets> + "/charybdis.key.pem";
@@ -51,8 +53,15 @@ in {
 
     systemd.services.charybdis = {
       wantedBy = [ "multi-user.target" ];
-      requires = [ "secret.service" ];
-      after = [ "network-online.target" "secret.service" ];
+      after = [
+        config.krebs.secret.files.charybdis-ssl_dh_params.service
+        config.krebs.secret.files.charybdis-ssl_private_key.service
+        "network-online.target"
+      ];
+      partOf = [
+        config.krebs.secret.files.charybdis-ssl_dh_params.service
+        config.krebs.secret.files.charybdis-ssl_private_key.service
+      ];
       environment = {
         BANDB_DBPATH = "${cfg.user.home}/ban.db";
       };
diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix
index f16dfac86..aaf262fa1 100644
--- a/tv/3modules/ejabberd/default.nix
+++ b/tv/3modules/ejabberd/default.nix
@@ -18,6 +18,7 @@ in {
     certfile = mkOption {
       type = types.secret-file;
       default = {
+        name = "ejabberd-certfile";
         path = "${cfg.user.home}/ejabberd.pem";
         owner = cfg.user;
         source-path = toString <secrets> + "/ejabberd.pem";
@@ -26,6 +27,7 @@ in {
     dhfile = mkOption {
       type = types.secret-file;
       default = {
+        name = "ejabberd-dhfile";
         path = "${cfg.user.home}/dhparams.pem";
         owner = cfg.user;
         source-path = "/dev/null";
@@ -95,8 +97,15 @@ in {
 
     systemd.services.ejabberd = {
       wantedBy = [ "multi-user.target" ];
-      requires = [ "secret.service" ];
-      after = [ "network.target" "secret.service" ];
+      after = [
+        config.krebs.secret.files.ejabberd-certfile.service
+        config.krebs.secret.files.ejabberd-s2s_certfile.service
+        "network.target"
+      ];
+      partOf = [
+        config.krebs.secret.files.ejabberd-certfile.service
+        config.krebs.secret.files.ejabberd-s2s_certfile.service
+      ];
       serviceConfig = {
         ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
         ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground";
diff --git a/tv/3modules/x0vncserver.nix b/tv/3modules/x0vncserver.nix
index 44fed590d..ba79c4a49 100644
--- a/tv/3modules/x0vncserver.nix
+++ b/tv/3modules/x0vncserver.nix
@@ -12,6 +12,7 @@ in {
     enable = mkEnableOption "tv.x0vncserver";
     pwfile = mkOption {
       default = {
+        name = "x0vncserver-pwfile";
         owner = cfg.user;
         path = "${cfg.user.home}/.vncpasswd";
         source-path = toString <secrets> + "/vncpasswd";
@@ -36,8 +37,16 @@ in {
       x0vncserver-pwfile = cfg.pwfile;
     };
     systemd.services.x0vncserver = {
-      after = [ "graphical.target" "secret.service" ];
-      requires = [ "graphical.target" "secret.service" ];
+      after = [
+        config.krebs.secret.files.x0vncserver-pwfile.service
+        "graphical.target"
+      ];
+      partOf = [
+        config.krebs.secret.files.x0vncserver-pwfile.service
+      ];
+      requires = [
+        "graphical.target"
+      ];
       serviceConfig = {
         ExecStart = "${pkgs.tigervnc}/bin/x0vncserver ${toString [
           "-display ${cfg.display}"