5df59d2c7f
... this will make sense soon! Change-Id: I1f8f32d655afdf868fff4bd09e1fea2943fd7558 Reviewed-on: https://cl.tvl.fyi/c/depot/+/9496 Tested-by: BuildkiteCI Reviewed-by: tazjin <tazjin@tvl.su>
37 lines
1 KiB
Nix
37 lines
1 KiB
Nix
{ depot, pkgs, ... }:
|
|
|
|
{
|
|
imports = [
|
|
(depot.third_party.agenix.src + "/modules/age.nix")
|
|
];
|
|
|
|
age.secrets.geesefs-tazjins-files.file = depot.users.tazjin.secrets."geesefs-tazjins-files.age";
|
|
programs.fuse.userAllowOther = true;
|
|
|
|
systemd.services.geesefs = {
|
|
description = "geesefs @ tazjins-files";
|
|
wantedBy = [ "multi-user.target" ];
|
|
path = [ pkgs.fuse ];
|
|
|
|
serviceConfig = {
|
|
# TODO: can't get fusermount to work for non-root users (e.g. DynamicUser) here, why?
|
|
|
|
Restart = "always";
|
|
LoadCredential = "geesefs-tazjins-files:/run/agenix/geesefs-tazjins-files";
|
|
StateDirectory = "geesefs";
|
|
};
|
|
|
|
script = ''
|
|
set -u # bail out if systemd is misconfigured ...
|
|
set -x
|
|
|
|
mkdir -p $STATE_DIRECTORY/tazjins-files $STATE_DIRECTORY/cache
|
|
|
|
${depot.third_party.geesefs}/bin/geesefs \
|
|
-f -o allow_other \
|
|
--cache $STATE_DIRECTORY/cache \
|
|
--shared-config $CREDENTIALS_DIRECTORY/geesefs-tazjins-files \
|
|
tazjins-files $STATE_DIRECTORY/tazjins-files
|
|
'';
|
|
};
|
|
}
|