danvics/selfhostblocks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Do not use activation script for script with dependencies (#348)

Browse source 
The issue with activation script is the order is alphabetical, meaning
the order the script is assembled is not really set in stone.

Here, because the script had a name starting with `restic`, it was ran
before the `sops` secret generation script. And since the restic script
was trying to use the secrets, it failed.

And if the activation script fails, you get a kernel panic.
This commit is contained in:
Pierre Penninckx 2024-11-15 22:05:01 +01:00 committed by GitHub
parent 6bdd8febe3
commit 4726593ea9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
modules/blocks/restic.nix
View file

@ -363,10 +363,13 @@ in
mkMerge (flatten (mapAttrsToList mkSettings (enabledInstances // enabledDatabases)));
}
{
system.activationScripts = let
systemd.services = let
mkEnv = name: instance:
nameValuePair "${fullName name instance.settings.repository}_gen"
(shblib.replaceSecrets {
nameValuePair "${fullName name instance.settings.repository}_restore_gen" {
enable = true;
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot";
script = (shblib.replaceSecrets {
userConfig = instance.settings.repository.secrets // {
RESTIC_PASSWORD_FILE = instance.settings.passphraseFile;
RESTIC_REPOSITORY = instance.settings.repository.path;
@ -375,6 +378,7 @@ in
generator = name: v: pkgs.writeText (fullName name instance.settings.repository) (generators.toINIWithGlobalSection {} { globalSection = v; });
user = instance.request.user;
});
};
in
listToAttrs (flatten (mapAttrsToList mkEnv (cfg.instances // cfg.databases)));
}