pkg/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2026-07-17 14:35:25 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix(systemd): require mounts for encryption keys.

Browse source 
This helps address issues in https://github.com/nix-community/impermanence/issues/294 and in general also works for https://github.com/nix-community/preservation type of workflows which also rely on systemd mounts.
This commit is contained in:
Nicolas Dumazet 2026-03-21 10:49:43 +01:00
parent bc02e2e5f6
commit fbedbb8cb1
2 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
modules/sops/default.nix
View file

@ -484,6 +484,12 @@ in
ExecStart = [ "${cfg.package}/bin/sops-install-secrets ${manifest}" ]; ExecStart = [ "${cfg.package}/bin/sops-install-secrets ${manifest}" ];
RemainAfterExit = true; RemainAfterExit = true;
}; };
unitConfig.RequiresMountsFor = lib.concatLists [
(lib.lists.optional (cfg.gnupg.home != null) cfg.gnupg.home)
cfg.gnupg.sshKeyPaths
(lib.lists.optional (cfg.age.keyFile != null) cfg.age.keyFile)
cfg.age.sshKeyPaths
];
}; };
system.activationScripts = { system.activationScripts = {

6
modules/sops/secrets-for-users/default.nix
View file

@ -44,6 +44,12 @@ in
ExecStart = [ "${cfg.package}/bin/sops-install-secrets -ignore-passwd ${manifestForUsers}" ]; ExecStart = [ "${cfg.package}/bin/sops-install-secrets -ignore-passwd ${manifestForUsers}" ];
RemainAfterExit = true; RemainAfterExit = true;
}; };
unitConfig.RequiresMountsFor = lib.concatLists [
(lib.lists.optional (cfg.gnupg.home != null) cfg.gnupg.home)
cfg.gnupg.sshKeyPaths
(lib.lists.optional (cfg.age.keyFile != null) cfg.age.keyFile)
cfg.age.sshKeyPaths
];
}; };
system.activationScripts = lib.mkIf (secretsForUsers != { } && !useSystemdActivation) { system.activationScripts = lib.mkIf (secretsForUsers != { } && !useSystemdActivation) {