From 6a3c43d7160939bc4c33fbb26df946280e7c8216 Mon Sep 17 00:00:00 2001 From: ibizaman Date: Fri, 15 Nov 2024 21:46:17 +0100 Subject: [PATCH] do not use activation script for script with dependencies The issue with activation script is the order is alphabetical, meaning the order the script is assembled is not really set in stone. Here, because the script had a name starting with `restic`, it was ran before the `sops` secret generation script. And since the restic script was trying to use the secrets, it failed. --- modules/blocks/restic.nix | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/modules/blocks/restic.nix b/modules/blocks/restic.nix index e9c3351..2753023 100644 --- a/modules/blocks/restic.nix +++ b/modules/blocks/restic.nix @@ -363,10 +363,13 @@ in mkMerge (flatten (mapAttrsToList mkSettings (enabledInstances // enabledDatabases))); } { - system.activationScripts = let + systemd.services = let mkEnv = name: instance: - nameValuePair "${fullName name instance.settings.repository}_gen" - (shblib.replaceSecrets { + nameValuePair "${fullName name instance.settings.repository}_restore_gen" { + enable = true; + wantedBy = [ "multi-user.target" ]; + serviceConfig.Type = "oneshot"; + script = (shblib.replaceSecrets { userConfig = instance.settings.repository.secrets // { RESTIC_PASSWORD_FILE = instance.settings.passphraseFile; RESTIC_REPOSITORY = instance.settings.repository.path; @@ -375,6 +378,7 @@ in generator = name: v: pkgs.writeText (fullName name instance.settings.repository) (generators.toINIWithGlobalSection {} { globalSection = v; }); user = instance.request.user; }); + }; in listToAttrs (flatten (mapAttrsToList mkEnv (cfg.instances // cfg.databases))); }