liminix

commit a795591e218335ae964630d194f541d585ec71e5
parent 717608d954be64afbcff7e4e7f5a119bec9a92a7
Author: Daniel Barlow <dan@telent.net>
Date:   Mon, 17 Aug 2026 12:59:40 +0100

secrets subscriber: depend on watched service(s)

if the secrets service has a long chain of dependencies (e.g https
fetch which requires ntp which requires network ...) but the
restartable service (e.g. hostapd) would otherwise start at boot, it
might have timed out of its restart loop before we even get to the
point that it could start successfully with a valid config

hand on heart: I am unsure if this is the right thing. maybe
secrets-consuming services should be required to provide placeholders
if there is no secret yet? the consequnce of adding this dependency is
if the secrets service fails, then the services depending on it will
all be brought down

Diffstat:
M
modules/secrets/subscriber.nix
 | 
7
+++++--

1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/modules/secrets/subscriber.nix b/modules/secrets/subscriber.nix
@@ -15,7 +15,7 @@
 let
   inherit (liminix.services) longrun;
   inherit (builtins) map;
-  inherit (lib) optional concatStringsSep;
+  inherit (lib) optionals optional concatStringsSep;
   inherit (service) name;
 
   restart-flag =
@@ -52,5 +52,8 @@ let
 in
 service.overrideAttrs (o: {
   buildInputs = (lim.orEmpty o.buildInputs) ++ optional (watch != [ ]) watcher;
-  dependencies = (lim.orEmpty o.dependencies) ++ optional (watch != [ ]) watcher;
+  dependencies =
+    (lim.orEmpty o.dependencies)
+    ++ optional (watch != [ ]) watcher
+    ++ optionals (watch != [ ]) (map (s: s "service") watch);
 })