diff options
Diffstat (limited to 'krebs')
| -rw-r--r-- | krebs/3modules/exim-smarthost.nix | 9 | ||||
| -rw-r--r-- | krebs/3modules/konsens.nix | 2 | ||||
| -rw-r--r-- | krebs/3modules/repo-sync.nix | 9 | ||||
| -rw-r--r-- | krebs/3modules/secret.nix | 68 | ||||
| -rw-r--r-- | krebs/3modules/tinc.nix | 10 |
5 files changed, 64 insertions, 34 deletions
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix index e988fb563..c5969caac 100644 --- a/krebs/3modules/exim-smarthost.nix +++ b/krebs/3modules/exim-smarthost.nix @@ -26,6 +26,7 @@ let private_key = mkOption { type = types.secret-file; default = { + name = "exim.dkim_private_key/${config.domain}"; path = "/run/krebs.secret/${config.domain}.dkim_private_key"; owner.name = "exim"; source-path = toString <secrets> + "/${config.domain}.dkim.priv"; @@ -115,8 +116,12 @@ let })); systemd.services = mkIf (cfg.dkim != []) { exim = { - after = [ "secret.service" ]; - requires = [ "secret.service" ]; + after = flip map cfg.dkim (dkim: + config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service + ); + partOf = flip map cfg.dkim (dkim: + config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service + ); }; }; krebs.exim = { diff --git a/krebs/3modules/konsens.nix b/krebs/3modules/konsens.nix index 74895a971..81486810b 100644 --- a/krebs/3modules/konsens.nix +++ b/krebs/3modules/konsens.nix @@ -56,7 +56,7 @@ let systemd.services = mapAttrs' (name: repo: nameValuePair "konsens-${name}" { - after = [ "network.target" "secret.service" ]; + after = [ "network.target" ]; path = [ pkgs.git ]; restartIfChanged = false; serviceConfig = { diff --git a/krebs/3modules/repo-sync.nix b/krebs/3modules/repo-sync.nix index 45d9d81c3..91111f3eb 100644 --- a/krebs/3modules/repo-sync.nix +++ b/krebs/3modules/repo-sync.nix @@ -124,6 +124,7 @@ let privateKeyFile = mkOption { type = types.secret-file; default = { + name = "repo-sync-key"; path = "${cfg.stateDir}/ssh.priv"; owner = cfg.user; source-path = toString <secrets> + "/repo-sync.ssh.key"; @@ -166,7 +167,13 @@ let }); in nameValuePair "repo-sync-${name}" { description = "repo-sync"; - after = [ "network.target" "secret.service" ]; + after = [ + config.krebs.secret.files.repo-sync-key.service + "network.target" + ]; + partOf = [ + config.krebs.secret.files.repo-sync-key.service + ]; environment = { GIT_SSH_COMMAND = "${pkgs.openssh}/bin/ssh -i ${cfg.stateDir}/ssh.priv"; diff --git a/krebs/3modules/secret.nix b/krebs/3modules/secret.nix index 672c503b0..bf2c62cc9 100644 --- a/krebs/3modules/secret.nix +++ b/krebs/3modules/secret.nix @@ -1,4 +1,5 @@ -{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let +with import <stockholm/lib>; +{ config, lib, pkgs, ... }: let cfg = config.krebs.secret; in { options.krebs.secret = { @@ -8,32 +9,43 @@ in { }; }; config = lib.mkIf (cfg.files != {}) { - systemd.services.secret = let - # TODO fail if two files have the same path but differ otherwise - files = unique (map (flip removeAttrs ["_module"]) - (attrValues cfg.files)); - in { - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = "yes"; - SyslogIdentifier = "secret"; - ExecStart = pkgs.writeDash "install-secret-files" '' - exit_code=0 - ${concatMapStringsSep "\n" (file: '' - ${pkgs.coreutils}/bin/install \ - -D \ - --compare \ - --verbose \ - --mode=${shell.escape file.mode} \ - --owner=${shell.escape file.owner.name} \ - --group=${shell.escape file.group-name} \ - ${shell.escape file.source-path} \ - ${shell.escape file.path} \ - || exit_code=1 - '') files} - exit $exit_code - ''; - }; - }; + systemd.paths = + mapAttrs' + (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" { + wantedBy = ["multi-user.target"]; + pathConfig.PathChanged = file.source-path; + }) + cfg.files; + systemd.services = + mapAttrs' + (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" { + wantedBy = ["multi-user.target"]; + serviceConfig = { + Type = "oneshot"; + ExecStart = "${pkgs.systemd}/bin/systemctl restart ${file.service}"; + }; + }) + cfg.files + // + mapAttrs' + (name: file: nameValuePair "secret-${systemd.encodeName name}" { + wantedBy = ["multi-user.target"]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = "yes"; + ExecStart = toString [ + "${pkgs.coreutils}/bin/install" + "-D" + "--compare" + "--verbose" + "--mode=${file.mode}" + "--owner=${file.owner.name}" + "--group=${file.group-name}" + file.source-path + file.path + ]; + }; + }) + cfg.files; }; } diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix index 8b6e959d4..1fca7de5c 100644 --- a/krebs/3modules/tinc.nix +++ b/krebs/3modules/tinc.nix @@ -158,6 +158,7 @@ let privkey = mkOption { type = types.secret-file; default = { + name = "${tinc.config.netname}.rsa_key.priv"; path = "${tinc.config.user.home}/tinc.rsa_key.priv"; owner = tinc.config.user; source-path = toString <secrets> + "/${tinc.config.netname}.rsa_key.priv"; @@ -219,9 +220,14 @@ let iproute = cfg.iproutePackage; in { description = "Tinc daemon for ${netname}"; - after = [ "network.target" ]; + after = [ + config.krebs.secret.files."${netname}.rsa_key.priv".service + "network.target" + ]; + partOf = [ + config.krebs.secret.files."${netname}.rsa_key.priv".service + ]; wantedBy = [ "multi-user.target" ]; - requires = [ "secret.service" ]; path = [ tinc iproute ]; serviceConfig = rec { Restart = "always"; |