sops-nix/modules/sops
r-vdp 81440e3757
sops-install-secrets: call systemctl directly when run as a systemd unit
When useSystemdActivation is enabled, sops-install-secrets.service runs
ordered Before=sysinit-reactivation.target, which switch-to-configuration
restarts *after* it has already consumed /run/nixos/activation-*-list.
Writing to those files from the service therefore does nothing on the
current switch and leaks into the next one.

NixOS 26.05 also deprecates the activation-list mechanism, printing a
warning whenever the files exist, with removal planned for 26.11.

The systemd unit now sets SOPS_RESTART_UNITS_VIA_SYSTEMCTL=1 so the
binary knows to call systemctl directly (try-restart /
try-reload-or-restart, --no-block to avoid deadlocking the sysinit
transaction). INVOCATION_ID cannot be used for this since
switch-to-configuration is almost always invoked from a process tree
rooted in some unit (sshd, getty, systemd-run), so the activation script
inherits it too. The legacy activation-script path keeps writing the
list files for backward compatibility.

Closes #934
2026-06-03 20:11:00 +03:00
..
secrets-for-users sops-install-secrets: call systemctl directly when run as a systemd unit 2026-06-03 20:11:00 +03:00
templates add uid and gid to templates 2025-03-17 20:29:15 +01:00
default.nix sops-install-secrets: call systemctl directly when run as a systemd unit 2026-06-03 20:11:00 +03:00
manifest-for.nix fix home-manager module 2025-03-17 10:54:23 +01:00
with-environment.nix reformat code base with nixfmt 2024-11-17 12:22:59 +01:00