From b5b90b598430cfa876639d76dbbdc8d826ccb5c0 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 4 Aug 2020 20:28:04 +0200 Subject: types.secret-file: add service option --- tv/2configs/binary-cache/default.nix | 8 ++++++-- tv/3modules/charybdis/default.nix | 11 +++++++++-- tv/3modules/ejabberd/default.nix | 11 +++++++++-- tv/3modules/x0vncserver.nix | 12 ++++++++++-- 4 files changed, 34 insertions(+), 8 deletions(-) (limited to 'tv') diff --git a/tv/2configs/binary-cache/default.nix b/tv/2configs/binary-cache/default.nix index 39c944b1a..970f705f0 100644 --- a/tv/2configs/binary-cache/default.nix +++ b/tv/2configs/binary-cache/default.nix @@ -9,8 +9,12 @@ }; systemd.services.nix-serve = { - requires = ["secret.service"]; - after = ["secret.service"]; + after = [ + config.krebs.secret.files.binary-cache-seckey.service + ]; + requires = [ + config.krebs.secret.files.binary-cache-seckey.service + ]; }; krebs.secret.files.binary-cache-seckey = { diff --git a/tv/3modules/charybdis/default.nix b/tv/3modules/charybdis/default.nix index 62a7037e3..3809da404 100644 --- a/tv/3modules/charybdis/default.nix +++ b/tv/3modules/charybdis/default.nix @@ -51,8 +51,15 @@ in { systemd.services.charybdis = { wantedBy = [ "multi-user.target" ]; - requires = [ "secret.service" ]; - after = [ "network-online.target" "secret.service" ]; + after = [ + config.krebs.secret.files.charybdis-ssl_dh_params.service + config.krebs.secret.files.charybdis-ssl_private_key.service + "network-online.target" + ]; + requires = [ + config.krebs.secret.files.charybdis-ssl_dh_params.service + config.krebs.secret.files.charybdis-ssl_private_key.service + ]; environment = { BANDB_DBPATH = "${cfg.user.home}/ban.db"; }; diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index f16dfac86..b995c145a 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -95,8 +95,15 @@ in { systemd.services.ejabberd = { wantedBy = [ "multi-user.target" ]; - requires = [ "secret.service" ]; - after = [ "network.target" "secret.service" ]; + after = [ + config.krebs.secret.files.ejabberd-certfile.service + config.krebs.secret.files.ejabberd-s2s_certfile.service + "network.target" + ]; + requires = [ + config.krebs.secret.files.ejabberd-certfile.service + config.krebs.secret.files.ejabberd-s2s_certfile.service + ]; serviceConfig = { ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}"; ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground"; diff --git a/tv/3modules/x0vncserver.nix b/tv/3modules/x0vncserver.nix index 44fed590d..8b9cfa89d 100644 --- a/tv/3modules/x0vncserver.nix +++ b/tv/3modules/x0vncserver.nix @@ -36,8 +36,16 @@ in { x0vncserver-pwfile = cfg.pwfile; }; systemd.services.x0vncserver = { - after = [ "graphical.target" "secret.service" ]; - requires = [ "graphical.target" "secret.service" ]; + after = [ + config.krebs.secret.files.x0vncserver-pwfile.service + "graphical.target" + ]; + partOf = [ + config.krebs.secret.files.x0vncserver-pwfile.service + ]; + requires = [ + "graphical.target" + ]; serviceConfig = { ExecStart = "${pkgs.tigervnc}/bin/x0vncserver ${toString [ "-display ${cfg.display}" -- cgit v1.2.3 From ec91d1b83cfad151033433159a04eb7b5381bc73 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 4 Aug 2020 22:22:43 +0200 Subject: krebs.secret: restart units on secret change --- tv/2configs/binary-cache/default.nix | 2 +- tv/3modules/charybdis/default.nix | 4 +++- tv/3modules/ejabberd/default.nix | 4 +++- tv/3modules/x0vncserver.nix | 1 + 4 files changed, 8 insertions(+), 3 deletions(-) (limited to 'tv') diff --git a/tv/2configs/binary-cache/default.nix b/tv/2configs/binary-cache/default.nix index 970f705f0..866434cb5 100644 --- a/tv/2configs/binary-cache/default.nix +++ b/tv/2configs/binary-cache/default.nix @@ -12,7 +12,7 @@ after = [ config.krebs.secret.files.binary-cache-seckey.service ]; - requires = [ + partOf = [ config.krebs.secret.files.binary-cache-seckey.service ]; }; diff --git a/tv/3modules/charybdis/default.nix b/tv/3modules/charybdis/default.nix index 3809da404..a0638e1eb 100644 --- a/tv/3modules/charybdis/default.nix +++ b/tv/3modules/charybdis/default.nix @@ -17,6 +17,7 @@ in { ssl_dh_params = mkOption { type = types.secret-file; default = { + name = "charybdis-ssl_dh_params"; path = "${cfg.user.home}/dh.pem"; owner = cfg.user; source-path = toString + "/charybdis.dh.pem"; @@ -25,6 +26,7 @@ in { ssl_private_key = mkOption { type = types.secret-file; default = { + name = "charybdis-ssl_private_key"; path = "${cfg.user.home}/ssl.key.pem"; owner = cfg.user; source-path = toString + "/charybdis.key.pem"; @@ -56,7 +58,7 @@ in { config.krebs.secret.files.charybdis-ssl_private_key.service "network-online.target" ]; - requires = [ + partOf = [ config.krebs.secret.files.charybdis-ssl_dh_params.service config.krebs.secret.files.charybdis-ssl_private_key.service ]; diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index b995c145a..aaf262fa1 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -18,6 +18,7 @@ in { certfile = mkOption { type = types.secret-file; default = { + name = "ejabberd-certfile"; path = "${cfg.user.home}/ejabberd.pem"; owner = cfg.user; source-path = toString + "/ejabberd.pem"; @@ -26,6 +27,7 @@ in { dhfile = mkOption { type = types.secret-file; default = { + name = "ejabberd-dhfile"; path = "${cfg.user.home}/dhparams.pem"; owner = cfg.user; source-path = "/dev/null"; @@ -100,7 +102,7 @@ in { config.krebs.secret.files.ejabberd-s2s_certfile.service "network.target" ]; - requires = [ + partOf = [ config.krebs.secret.files.ejabberd-certfile.service config.krebs.secret.files.ejabberd-s2s_certfile.service ]; diff --git a/tv/3modules/x0vncserver.nix b/tv/3modules/x0vncserver.nix index 8b9cfa89d..ba79c4a49 100644 --- a/tv/3modules/x0vncserver.nix +++ b/tv/3modules/x0vncserver.nix @@ -12,6 +12,7 @@ in { enable = mkEnableOption "tv.x0vncserver"; pwfile = mkOption { default = { + name = "x0vncserver-pwfile"; owner = cfg.user; path = "${cfg.user.home}/.vncpasswd"; source-path = toString + "/vncpasswd"; -- cgit v1.2.3