pkg/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2026-05-01 10:55:46 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

sops-install-secrets: call systemctl directly when run as a systemd unit

Browse source 
When useSystemdActivation is enabled, sops-install-secrets.service runs
ordered Before=sysinit-reactivation.target, which switch-to-configuration
restarts *after* it has already consumed /run/nixos/activation-*-list.
Writing to those files from the service therefore does nothing on the
current switch and leaks into the next one.

NixOS 26.05 also deprecates the activation-list mechanism, printing a
warning whenever the files exist, with removal planned for 26.11.

Detect systemd invocation via INVOCATION_ID and call systemctl directly
(try-restart / try-reload-or-restart, --no-block to avoid deadlocking
the sysinit transaction). The legacy activation-script path keeps
writing the list files for backward compatibility.
This commit is contained in:
r-vdp 2026-03-30 15:49:09 +02:00
parent 8adb84861f
commit 6f5fe8036b
No known key found for this signature in database
3 changed files with 81 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

2
modules/sops/default.nix
View file

@ -472,7 +472,7 @@ in
before = [ "sysinit-reactivation.target" ];
environment = cfg.environment;
unitConfig.DefaultDependencies = "no";
path = cfg.age.plugins;
path = cfg.age.plugins ++ [ config.systemd.package ];
serviceConfig = {
Type = "oneshot";

2
modules/sops/secrets-for-users/default.nix
View file

@ -37,7 +37,7 @@ in
before = [ "systemd-sysusers.service" ];
environment = cfg.environment;
unitConfig.DefaultDependencies = "no";
path = cfg.age.plugins;
path = cfg.age.plugins ++ [ config.systemd.package ];
serviceConfig = {
Type = "oneshot";