nix-bitcoin/modules/deployment/krops.nix

25 lines
907 B
Nix
Raw Normal View History

2021-03-10 05:08:39 -08:00
{ lib, ... }:
{
nix-bitcoin = {
secretsDir = "/var/src/secrets";
setupSecrets = true;
};
environment.variables.NIX_PATH = lib.mkForce "/var/src";
# The file syncing step in krops resets the secrets file permissions.
# So force `setup-secrets.service` to restart on deployment.
# Stop it at activation start so that it gets restarted at the end.
system.activationScripts.nixBitcoinStopSetupSecrets = ''
${/* Skip this step if systemd is not running, i.e. when booting or in nixos-install */ ""}
if [[ -e /run/systemd/system ]]; then
if ! output=$(/run/current-system/systemd/bin/systemctl stop setup-secrets.service --no-block 2>&1); then
# Ignore if the unit is not loaded, which can happen on the first deployment
if [[ $output != *setup-secrets.service\ not\ loaded* ]]; then
echo "$output"
false
fi
fi
fi
'';
}