DGNum/agenix
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Ensure /run is created before mounting secrets

Browse source 
Otherwise /run/agenix might disappear if specialfs is toposorted
between agenixMountSecrets and agenixRoot.

Fixes: https://github.com/ryantm/agenix/issues/92
This commit is contained in:
Jan Tojnar 2022-01-06 22:50:56 +01:00
parent c5558c88b2
commit 26edd03a5a
1 changed files with 20 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
modules/age.nix
View file

@ -147,7 +147,8 @@ in
# Create a new directory full of secrets for symlinking (this helps # Create a new directory full of secrets for symlinking (this helps
# ensure removed secrets are actually removed, or at least become # ensure removed secrets are actually removed, or at least become
# invalid symlinks). # invalid symlinks).
system.activationScripts.agenixMountSecrets = '' system.activationScripts.agenixMountSecrets = {
text = ''
_agenix_generation="$(basename "$(readlink /run/agenix)" || echo 0)" _agenix_generation="$(basename "$(readlink /run/agenix)" || echo 0)"
(( ++_agenix_generation )) (( ++_agenix_generation ))
echo "[agenix] symlinking new secrets to /run/agenix (generation $_agenix_generation)..." echo "[agenix] symlinking new secrets to /run/agenix (generation $_agenix_generation)..."
@ -163,6 +164,10 @@ in
rm -rf "${cfg.secretsMountPoint}/$(( _agenix_generation - 1 ))" rm -rf "${cfg.secretsMountPoint}/$(( _agenix_generation - 1 ))"
} }
''; '';
deps = [
"specialfs"
];
};
# Secrets with root owner and group can be installed before users # Secrets with root owner and group can be installed before users
# exist. This allows user password files to be encrypted. # exist. This allows user password files to be encrypted.