pkg/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2026-04-10 20:53:06 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(systemd): require mounts for encryption keys.

Browse source 
This helps address issues in https://github.com/nix-community/impermanence/issues/294 and in general also works for https://github.com/nix-community/preservation type of workflows which also rely on systemd mounts.
This commit is contained in:
Nicolas Dumazet 2026-03-21 10:49:43 +01:00 • committed by Nicolas Dumazet
parent 81f2258e00
commit 1177a6f475
2 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
modules/sops/default.nix
View file

@ -484,6 +484,12 @@ in
ExecStart = [ "${cfg.package}/bin/sops-install-secrets ${manifest}" ];
RemainAfterExit = true;
};
unitConfig.RequiresMountsFor = lib.concatLists [
(lib.lists.optional (cfg.gnupg.home != null) cfg.gnupg.home)
cfg.gnupg.sshKeyPaths
(lib.lists.optional (cfg.age.keyFile != null) cfg.age.keyFile)
cfg.age.sshKeyPaths
];
};
system.activationScripts = {

6
modules/sops/secrets-for-users/default.nix
View file

@ -44,6 +44,12 @@ in
ExecStart = [ "${cfg.package}/bin/sops-install-secrets -ignore-passwd ${manifestForUsers}" ];
RemainAfterExit = true;
};
unitConfig.RequiresMountsFor = lib.concatLists [
(lib.lists.optional (cfg.gnupg.home != null) cfg.gnupg.home)
cfg.gnupg.sshKeyPaths
(lib.lists.optional (cfg.age.keyFile != null) cfg.age.keyFile)
cfg.age.sshKeyPaths
];
};
system.activationScripts = lib.mkIf (secretsForUsers != { } && !useSystemdActivation) {