feat: works with sysuser

fix: darwin compatible chore: reformat Co-authored-by: Cole Helbling <[email protected]>
ryantm · Apr 7, 2024 · 12607ed · 12607ed
1 parent 1381a75
commit 12607ed
Showing 1 changed file with 27 additions and 1 deletion.
diff --git a/modules/age.nix b/modules/age.nix
@@ -14,6 +14,11 @@ with lib; let
 
   users = config.users.users;
 
+  sysusersEnabled =
+    if isDarwin
+    then false
+    else config.systemd.sysusers.enable or false;
+
   mountCommand =
     if isDarwin
     then ''
@@ -262,7 +267,28 @@ in {
       ];
     }
 
-    (optionalAttrs (!isDarwin) {
+    (optionalAttrs sysusersEnabled {
+      # When using sysusers we no longer be started as an activation script
+      # because those are started in initrd while sysusers is started later.
+      systemd.services.agenix-install-secrets = {
+        wantedBy = ["sysinit.target"];
+        after = ["systemd-sysusers.service"];
+        unitConfig.DefaultDependencies = "no";
+
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = pkgs.writeShellScript "agenix-install" (
+            builtins.concatStringsSep "\n" [
+              newGeneration
+              installSecrets
+              chownSecrets
+            ]
+          );
+          RemainAfterExit = true;
+        };
+      };
+    })
+    (optionalAttrs (!isDarwin && !sysusersEnabled) {
       # Create a new directory full of secrets for symlinking (this helps
       # ensure removed secrets are actually removed, or at least become
       # invalid symlinks).