feat(tazjin/nixos): add geesefs mount unit for koptevo ...

... this will make sense soon!

Change-Id: I1f8f32d655afdf868fff4bd09e1fea2943fd7558
Reviewed-on: https://cl.tvl.fyi/c/depot/+/9496
Tested-by: BuildkiteCI
Reviewed-by: tazjin <tazjin@tvl.su>
This commit is contained in:
Vincent Ambo 2023-09-30 22:24:21 +03:00 committed by tazjin
parent d3a59662ca
commit 5df59d2c7f
2 changed files with 38 additions and 0 deletions

View file

@ -15,6 +15,7 @@ in
(usermod "monica.nix")
(usermod "predlozhnik.nix")
(usermod "tgsa.nix")
(usermod "geesefs.nix")
(depot.third_party.agenix.src + "/modules/age.nix")
];

View file

@ -0,0 +1,37 @@
{ depot, pkgs, ... }:
{
imports = [
(depot.third_party.agenix.src + "/modules/age.nix")
];
age.secrets.geesefs-tazjins-files.file = depot.users.tazjin.secrets."geesefs-tazjins-files.age";
programs.fuse.userAllowOther = true;
systemd.services.geesefs = {
description = "geesefs @ tazjins-files";
wantedBy = [ "multi-user.target" ];
path = [ pkgs.fuse ];
serviceConfig = {
# TODO: can't get fusermount to work for non-root users (e.g. DynamicUser) here, why?
Restart = "always";
LoadCredential = "geesefs-tazjins-files:/run/agenix/geesefs-tazjins-files";
StateDirectory = "geesefs";
};
script = ''
set -u # bail out if systemd is misconfigured ...
set -x
mkdir -p $STATE_DIRECTORY/tazjins-files $STATE_DIRECTORY/cache
${depot.third_party.geesefs}/bin/geesefs \
-f -o allow_other \
--cache $STATE_DIRECTORY/cache \
--shared-config $CREDENTIALS_DIRECTORY/geesefs-tazjins-files \
tazjins-files $STATE_DIRECTORY/tazjins-files
'';
};
}