mynix/agenix
1
0
Fork 0
mirror of https://github.com/ryantm/agenix.git synced 2024-11-25 02:58:30 +03:00
Code Issues Projects Releases Packages Wiki Activity

Ensure /run is created before mounting secrets

Browse source 
Otherwise /run/agenix might disappear if specialfs is toposorted
between agenixMountSecrets and agenixRoot.

Fixes: https://github.com/ryantm/agenix/issues/92
This commit is contained in:
Jan Tojnar 2022-01-06 22:50:56 +01:00
parent c5558c88b2
commit 26edd03a5a
1 changed files with 20 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
modules/age.nix
View file

@ -147,7 +147,8 @@ in
# Create a new directory full of secrets for symlinking (this helps
# ensure removed secrets are actually removed, or at least become
# invalid symlinks).
system.activationScripts.agenixMountSecrets = ''
system.activationScripts.agenixMountSecrets = {
text = ''
_agenix_generation="$(basename "$(readlink /run/agenix)" || echo 0)"
(( ++_agenix_generation ))
echo "[agenix] symlinking new secrets to /run/agenix (generation $_agenix_generation)..."
@ -163,6 +164,10 @@ in
rm -rf "${cfg.secretsMountPoint}/$(( _agenix_generation - 1 ))"
}
'';
deps = [
"specialfs"
];
};
# Secrets with root owner and group can be installed before users
# exist. This allows user password files to be encrypted.