From 384534bf86de05eaef0f4ff3b45c9ea7c82832da Mon Sep 17 00:00:00 2001 From: h7x4 Date: Wed, 22 Jul 2026 17:38:28 +0900 Subject: [PATCH] treewide: add missing systemd ordering directives In particular, we were missing `sops-install-secrets.service` in a ton of places, and `network-online.target` for some homebrewn services. This has caused failure of some services on machine startup. --- .../services/idp-simplesamlphp/default.nix | 5 + .../bekkalokk/services/mediawiki/default.nix | 2 + hosts/bekkalokk/services/vaultwarden.nix | 5 + .../bekkalokk/services/webmail/roundcube.nix | 5 + hosts/bekkalokk/services/website/default.nix | 5 + hosts/bicep/services/calendar-bot.nix | 5 + hosts/bicep/services/git-mirrors/default.nix | 2 + hosts/bicep/services/matrix/coturn.nix | 5 + hosts/bicep/services/matrix/discord.nix | 2 + .../services/matrix/hookshot/default.nix | 1 + hosts/bicep/services/matrix/livekit.nix | 7 +- hosts/bicep/services/matrix/mjolnir.nix | 97 ++++++++++--------- .../services/matrix/out-of-your-element.nix | 8 ++ hosts/bicep/services/matrix/synapse.nix | 7 +- hosts/bicep/services/minecraft-heatmap.nix | 9 ++ hosts/bicep/services/mysql/default.nix | 4 + hosts/gluttony/services/bluemap.nix | 9 ++ hosts/ildkule/services/monitoring/grafana.nix | 5 + .../monitoring/prometheus/postgres.nix | 13 ++- hosts/kommode/services/gitea/default.nix | 13 ++- hosts/kommode/services/gitea/gpg.nix | 4 + .../services/gitea/import-users/default.nix | 10 ++ .../gitea/web-secret-provider/default.nix | 11 ++- hosts/lupine/services/openvpn.nix | 5 + hosts/skrot/services/drumknotty.nix | 5 + hosts/temmie/services/userweb/passwd-sync.nix | 6 ++ modules/matrix-ooye.nix | 6 +- 27 files changed, 200 insertions(+), 56 deletions(-) diff --git a/hosts/bekkalokk/services/idp-simplesamlphp/default.nix b/hosts/bekkalokk/services/idp-simplesamlphp/default.nix index 1781f46..90c37bf 100644 --- a/hosts/bekkalokk/services/idp-simplesamlphp/default.nix +++ b/hosts/bekkalokk/services/idp-simplesamlphp/default.nix @@ -177,6 +177,11 @@ in }; }; + systemd.services."phpfpm-idp" = { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + }; + services.nginx.virtualHosts."idp.pvv.ntnu.no" = { forceSSL = true; enableACME = true; diff --git a/hosts/bekkalokk/services/mediawiki/default.nix b/hosts/bekkalokk/services/mediawiki/default.nix index 2676b0a..8857697 100644 --- a/hosts/bekkalokk/services/mediawiki/default.nix +++ b/hosts/bekkalokk/services/mediawiki/default.nix @@ -287,6 +287,7 @@ in { systemd.services.mediawiki-init = lib.mkIf cfg.enable { after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; serviceConfig = { UMask = lib.mkForce "0007"; }; @@ -294,6 +295,7 @@ in { systemd.services.phpfpm-mediawiki = lib.mkIf cfg.enable { after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; serviceConfig = { UMask = lib.mkForce "0007"; }; diff --git a/hosts/bekkalokk/services/vaultwarden.nix b/hosts/bekkalokk/services/vaultwarden.nix index 0429376..b208c10 100644 --- a/hosts/bekkalokk/services/vaultwarden.nix +++ b/hosts/bekkalokk/services/vaultwarden.nix @@ -61,6 +61,11 @@ in { }; }; + systemd.services.vaultwarden = { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + }; + services.nginx.virtualHosts."${domain}" = { forceSSL = true; enableACME = true; diff --git a/hosts/bekkalokk/services/webmail/roundcube.nix b/hosts/bekkalokk/services/webmail/roundcube.nix index 0760642..66c3b5e 100644 --- a/hosts/bekkalokk/services/webmail/roundcube.nix +++ b/hosts/bekkalokk/services/webmail/roundcube.nix @@ -49,6 +49,11 @@ in ''; }; + systemd.services."phpfpm-roundcube" = { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + }; + # TODO: move this back to `webmail.pvv.ntnu.no/roundcube` subpath services.nginx.virtualHosts.${domain} = { diff --git a/hosts/bekkalokk/services/website/default.nix b/hosts/bekkalokk/services/website/default.nix index 15562e2..c1776e7 100644 --- a/hosts/bekkalokk/services/website/default.nix +++ b/hosts/bekkalokk/services/website/default.nix @@ -116,6 +116,11 @@ in { ]; }; + systemd.services."phpfpm-pvv-nettsiden" = { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + }; + services.nginx.virtualHosts."pvv.ntnu.no" = { globalRedirect = cfg.domainName; redirectCode = 307; diff --git a/hosts/bicep/services/calendar-bot.nix b/hosts/bicep/services/calendar-bot.nix index ad5bbe5..cf1a88c 100644 --- a/hosts/bicep/services/calendar-bot.nix +++ b/hosts/bicep/services/calendar-bot.nix @@ -35,4 +35,9 @@ in { onCalendar = "*-*-* 09:00:00"; }; }; + + systemd.services.pvv-calendar-bot = { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + }; } diff --git a/hosts/bicep/services/git-mirrors/default.nix b/hosts/bicep/services/git-mirrors/default.nix index e691c13..bc24319 100644 --- a/hosts/bicep/services/git-mirrors/default.nix +++ b/hosts/bicep/services/git-mirrors/default.nix @@ -20,6 +20,8 @@ in lfs = false; }; + # TODO: add a module setting to specify additional systemd dependencies + # and then mark "sops-install-secrets.service" as a dependency here instances = let defaultGithubConfig = { settings.token_file = config.sops.secrets."gickup/github-token".path; diff --git a/hosts/bicep/services/matrix/coturn.nix b/hosts/bicep/services/matrix/coturn.nix index c2f218f..a292de4 100644 --- a/hosts/bicep/services/matrix/coturn.nix +++ b/hosts/bicep/services/matrix/coturn.nix @@ -55,6 +55,11 @@ # It needs this to be allowed to access the files with the acme group systemd.services.coturn.serviceConfig.PrivateUsers = lib.mkForce false; + systemd.services.coturn = { + requires = [ "sops-install-secrets.service" ]; + after = [ "sops-install-secrets.service" ]; + }; + systemd.services."acme-${config.services.coturn.realm}".serviceConfig = { AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ]; }; diff --git a/hosts/bicep/services/matrix/discord.nix b/hosts/bicep/services/matrix/discord.nix index 726f1ef..7841c09 100644 --- a/hosts/bicep/services/matrix/discord.nix +++ b/hosts/bicep/services/matrix/discord.nix @@ -39,6 +39,8 @@ in }; systemd.services.mx-puppet-discord = { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; serviceConfig.SupplementaryGroups = [ config.users.groups.keys-matrix-registrations.name ]; diff --git a/hosts/bicep/services/matrix/hookshot/default.nix b/hosts/bicep/services/matrix/hookshot/default.nix index 4c2aa7d..0ff9857 100644 --- a/hosts/bicep/services/matrix/hookshot/default.nix +++ b/hosts/bicep/services/matrix/hookshot/default.nix @@ -183,6 +183,7 @@ in }; services.matrix-hookshot.serviceDependencies = [ + "sops-install-secrets.service" "matrix-synapse.target" "nginx.service" ]; diff --git a/hosts/bicep/services/matrix/livekit.nix b/hosts/bicep/services/matrix/livekit.nix index 3342404..57341ed 100644 --- a/hosts/bicep/services/matrix/livekit.nix +++ b/hosts/bicep/services/matrix/livekit.nix @@ -43,7 +43,12 @@ in keyFile = config.sops.templates."matrix-livekit-keyfile".path; }; - systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = lib.mkIf cfg.enable (builtins.concatStringsSep "," [ "pvv.ntnu.no" "dodsorf.as" ]); + systemd.services.lk-jwt-service = lib.mkIf cfg.enable { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + + environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = builtins.concatStringsSep "," [ "pvv.ntnu.no" "dodsorf.as" ]; + }; services.nginx.virtualHosts.${matrixDomain} = lib.mkIf cfg.enable { locations."^~ /livekit/jwt/" = { diff --git a/hosts/bicep/services/matrix/mjolnir.nix b/hosts/bicep/services/matrix/mjolnir.nix index 0ec47e6..dc46c29 100644 --- a/hosts/bicep/services/matrix/mjolnir.nix +++ b/hosts/bicep/services/matrix/mjolnir.nix @@ -55,52 +55,57 @@ pantalaimon.username = "bot_admin"; }; - systemd.services.mjolnir.serviceConfig = { - DynamicUser = true; - RuntimeDirectory = [ "mjolnir/root-mnt" ]; - RootDirectory = "/run/mjolnir/root-mnt"; - BindReadOnlyPaths = [ - config.sops.secrets."matrix/mjolnir/access_token".path - builtins.storeDir - "/etc" - "/run/nscd" - "/var/run/nscd" - ]; + systemd.services.mjolnir = { + requires = [ "sops-install-secrets.service" ]; + after = [ "sops-install-secrets.service" ]; - AmbientCapabilities = ""; - CapabilityBoundingSet = ""; - LockPersonality = true; - MemoryDenyWriteExecute = false; # node needs this - NoNewPrivileges = true; - PrivateDevices = true; - PrivateMounts = true; - PrivateTmp = true; - PrivateUsers = true; - ProcSubset = "pid"; - ProtectClock = true; - ProtectControlGroups = true; - ProtectHome = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectKernelModules = true; - ProtectKernelTunables = true; - ProtectProc = "invisible"; - ProtectSystem = "strict"; - RemoveIPC = true; - RestrictAddressFamilies = [ - "AF_INET" - "AF_INET6" - "AF_UNIX" - ]; - RestrictNamespaces = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - SystemCallArchitectures = "native"; - SystemCallFilter = [ - "@system-service" - "~@privileged" - "~@resources" - ]; - UMask = "0077"; + serviceConfig = { + DynamicUser = true; + RuntimeDirectory = [ "mjolnir/root-mnt" ]; + RootDirectory = "/run/mjolnir/root-mnt"; + BindReadOnlyPaths = [ + config.sops.secrets."matrix/mjolnir/access_token".path + builtins.storeDir + "/etc" + "/run/nscd" + "/var/run/nscd" + ]; + + AmbientCapabilities = ""; + CapabilityBoundingSet = ""; + LockPersonality = true; + MemoryDenyWriteExecute = false; # node needs this + NoNewPrivileges = true; + PrivateDevices = true; + PrivateMounts = true; + PrivateTmp = true; + PrivateUsers = true; + ProcSubset = "pid"; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "invisible"; + ProtectSystem = "strict"; + RemoveIPC = true; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + "AF_UNIX" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ + "@system-service" + "~@privileged" + "~@resources" + ]; + UMask = "0077"; + }; }; } diff --git a/hosts/bicep/services/matrix/out-of-your-element.nix b/hosts/bicep/services/matrix/out-of-your-element.nix index 10fba8b..77ccfff 100644 --- a/hosts/bicep/services/matrix/out-of-your-element.nix +++ b/hosts/bicep/services/matrix/out-of-your-element.nix @@ -56,7 +56,15 @@ in enableSynapseIntegration = false; }; + systemd.services."matrix-ooye-pre-start" = { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + }; + systemd.services."matrix-ooye" = { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + serviceConfig = { RuntimeDirectory = [ "matrix-ooye/root-mnt" ]; RootDirectory = "/run/matrix-ooye/root-mnt"; diff --git a/hosts/bicep/services/matrix/synapse.nix b/hosts/bicep/services/matrix/synapse.nix index 230aa09..2ea67e2 100644 --- a/hosts/bicep/services/matrix/synapse.nix +++ b/hosts/bicep/services/matrix/synapse.nix @@ -44,6 +44,11 @@ in { }; }; + systemd.targets."matrix-synapse" = { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + }; + services.matrix-synapse-next = { enable = true; @@ -74,7 +79,7 @@ in { name = "psycopg2"; args = { host = "/var/run/postgresql"; - database = "synapse"; + dbname = "synapse"; user = "matrix-synapse"; cp_min = 1; cp_max = 5; diff --git a/hosts/bicep/services/minecraft-heatmap.nix b/hosts/bicep/services/minecraft-heatmap.nix index cdd1b03..ccdfabf 100644 --- a/hosts/bicep/services/minecraft-heatmap.nix +++ b/hosts/bicep/services/minecraft-heatmap.nix @@ -23,6 +23,15 @@ in }; systemd.services.minecraft-heatmap-ingest-logs = lib.mkIf cfg.enable { + after = [ + "sops-install-secrets.service" + "network-online.target" + ]; + requires = [ + "sops-install-secrets.service" + "network-online.target" + ]; + serviceConfig = { LoadCredential = [ "sshkey:${config.sops.secrets."minecraft-heatmap/ssh-key/private".path}" diff --git a/hosts/bicep/services/mysql/default.nix b/hosts/bicep/services/mysql/default.nix index a162053..4c152e5 100644 --- a/hosts/bicep/services/mysql/default.nix +++ b/hosts/bicep/services/mysql/default.nix @@ -56,9 +56,13 @@ in systemd.services.mysql = lib.mkIf cfg.enable { after = [ + "sops-install-secrets.service" "systemd-tmpfiles-setup.service" "systemd-tmpfiles-resetup.service" ]; + requires = [ + "sops-install-secrets.service" + ]; serviceConfig = { BindPaths = [ "${dataDir}:${cfg.dataDir}" ]; diff --git a/hosts/gluttony/services/bluemap.nix b/hosts/gluttony/services/bluemap.nix index ae8bb50..04d9e62 100644 --- a/hosts/gluttony/services/bluemap.nix +++ b/hosts/gluttony/services/bluemap.nix @@ -82,6 +82,15 @@ in { }; systemd.services."render-bluemap-maps" = { + after = [ + "sops-install-secrets.service" + "network-online.target" + ]; + requires = [ + "sops-install-secrets.service" + "network-online.target" + ]; + serviceConfig = { StateDirectory = [ "bluemap/world" ]; ExecStartPre = let diff --git a/hosts/ildkule/services/monitoring/grafana.nix b/hosts/ildkule/services/monitoring/grafana.nix index f5c251a..f8b772a 100644 --- a/hosts/ildkule/services/monitoring/grafana.nix +++ b/hosts/ildkule/services/monitoring/grafana.nix @@ -79,6 +79,11 @@ in { }; }; + systemd.services.grafana = { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + }; + services.nginx.virtualHosts.${cfg.settings.server.domain} = { enableACME = true; forceSSL = true; diff --git a/hosts/ildkule/services/monitoring/prometheus/postgres.nix b/hosts/ildkule/services/monitoring/prometheus/postgres.nix index 5cde1b2..f60cd69 100644 --- a/hosts/ildkule/services/monitoring/prometheus/postgres.nix +++ b/hosts/ildkule/services/monitoring/prometheus/postgres.nix @@ -37,9 +37,15 @@ in { }; }; - systemd.services.prometheus-postgres-exporter-knakelibrak.serviceConfig = let - localCfg = config.services.prometheus.exporters.postgres; - in lib.recursiveUpdate config.systemd.services.prometheus-postgres-exporter.serviceConfig { + systemd.services.prometheus-postgres-exporter-knakelibrak = { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + + # TODO: is it really necessary to use recursiveUpdate on the entire attrset here? + # Why don't we just update the relevant attrs directly? + serviceConfig = let + localCfg = config.services.prometheus.exporters.postgres; + in lib.recursiveUpdate config.systemd.services.prometheus-postgres-exporter.serviceConfig { EnvironmentFile = config.sops.secrets."keys/postgres/postgres_exporter_knakelibrak_env".path; ExecStart = '' ${pkgs.prometheus-postgres-exporter}/bin/postgres_exporter \ @@ -48,4 +54,5 @@ in { ${lib.concatStringsSep " \\\n " localCfg.extraFlags} ''; }; + }; } diff --git a/hosts/kommode/services/gitea/default.nix b/hosts/kommode/services/gitea/default.nix index e5308b8..4d24d39 100644 --- a/hosts/kommode/services/gitea/default.nix +++ b/hosts/kommode/services/gitea/default.nix @@ -154,8 +154,14 @@ in { environment.systemPackages = [ cfg.package ]; systemd.services.gitea = lib.mkIf cfg.enable { - wants = [ "redis-gitea.service" ]; - after = [ "redis-gitea.service" ]; + after = [ + "sops-install-secrets.service" + "redis-gitea.service" + ]; + requires = [ + "sops-install-secrets.service" + "redis-gitea.service" + ]; serviceConfig = { CPUSchedulingPolicy = "batch"; @@ -216,6 +222,9 @@ in { }; systemd.services.gitea-dump = { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + serviceConfig.ExecStart = let args = lib.cli.toCommandLineShellGNU { } { type = cfg.dump.type; diff --git a/hosts/kommode/services/gitea/gpg.nix b/hosts/kommode/services/gitea/gpg.nix index 1fd1ad5..4baa6d5 100644 --- a/hosts/kommode/services/gitea/gpg.nix +++ b/hosts/kommode/services/gitea/gpg.nix @@ -32,7 +32,11 @@ in systemd.services.gitea-ensure-gnupg-homedir = { description = "Import gpg key for gitea"; + before = [ "gitea.service" ]; + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + environment = { inherit GNUPGHOME; }; serviceConfig = { Type = "oneshot"; diff --git a/hosts/kommode/services/gitea/import-users/default.nix b/hosts/kommode/services/gitea/import-users/default.nix index 98ff64a..1e23dda 100644 --- a/hosts/kommode/services/gitea/import-users/default.nix +++ b/hosts/kommode/services/gitea/import-users/default.nix @@ -12,6 +12,16 @@ in systemd.services.gitea-import-users = lib.mkIf cfg.enable { enable = true; environment.PASSWD_FILE_PATH = "/run/gitea-import-users/passwd"; + after = [ + "sops-install-secrets.service" + "gitea.service" + "network-online.target" + ]; + requires = [ + "sops-install-secrets.service" + "gitea.service" + "network-online.target" + ]; serviceConfig = { ExecStartPre = ''${pkgs.rsync}/bin/rsync -e "${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=$CREDENTIALS_DIRECTORY/ssh-known-hosts -i $CREDENTIALS_DIRECTORY/sshkey" -a pvv@smtp.pvv.ntnu.no:/etc/passwd /run/gitea-import-users/passwd''; ExecStart = pkgs.writers.writePython3 "gitea-import-users" { diff --git a/hosts/kommode/services/gitea/web-secret-provider/default.nix b/hosts/kommode/services/gitea/web-secret-provider/default.nix index 80e8670..25feaff 100644 --- a/hosts/kommode/services/gitea/web-secret-provider/default.nix +++ b/hosts/kommode/services/gitea/web-secret-provider/default.nix @@ -48,7 +48,16 @@ in # %d - secrets directory systemd.services."gitea-web-secret-provider@" = { description = "Ensure all repos in %i has an SSH key to push web content"; - requires = [ "gitea.service" "network.target" ]; + after = [ + "sops-install-secrets.service" + "gitea.service" + "network-online.target" + ]; + requires = [ + "sops-install-secrets.service" + "gitea.service" + "network-online.target" + ]; serviceConfig = { Slice = "system-giteaweb.slice"; Type = "oneshot"; diff --git a/hosts/lupine/services/openvpn.nix b/hosts/lupine/services/openvpn.nix index c44c366..45c5397 100644 --- a/hosts/lupine/services/openvpn.nix +++ b/hosts/lupine/services/openvpn.nix @@ -94,6 +94,11 @@ in }; }; + systemd.services."openvpn-ov-firewall" = { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + }; + networking.firewall = { allowedTCPPorts = [ 1194 ]; allowedUDPPorts = [ 1194 ]; diff --git a/hosts/skrot/services/drumknotty.nix b/hosts/skrot/services/drumknotty.nix index 847c77e..06d5502 100644 --- a/hosts/skrot/services/drumknotty.nix +++ b/hosts/skrot/services/drumknotty.nix @@ -53,5 +53,10 @@ }; }; + systemd.services.drumknotty-screen-session = { + after = [ "sops-install-secrets.service" ]; + requires = [ "sops-install-secrets.service" ]; + }; + services.roowho2.settings.rwhod.ignoreUsers = [ "drumknotty" ]; } diff --git a/hosts/temmie/services/userweb/passwd-sync.nix b/hosts/temmie/services/userweb/passwd-sync.nix index 31e01f7..3deee16 100644 --- a/hosts/temmie/services/userweb/passwd-sync.nix +++ b/hosts/temmie/services/userweb/passwd-sync.nix @@ -29,9 +29,15 @@ in systemd.services."httpd-passwd-sync" = { requiredBy = [ "userweb.target" ]; after = [ + "network-online.target" + "sops-install-secrets.service" "systemd-tmpfiles-setup.service" "systemd-tmpfiles-resetup.service" ]; + requires = [ + "network-online.target" + "sops-install-secrets.service" + ]; serviceConfig = { Type = "oneshot"; Slice = "system-userweb.slice"; diff --git a/modules/matrix-ooye.nix b/modules/matrix-ooye.nix index cd146cf..9fd93e1 100644 --- a/modules/matrix-ooye.nix +++ b/modules/matrix-ooye.nix @@ -159,7 +159,6 @@ in description = "Out of Your Element - a Discord bridge for Matrix."; wants = [ - "network-online.target" "matrix-synapse.service" "conduit.service" "dendrite.service" @@ -168,7 +167,10 @@ in "matrix-ooye-pre-start.service" "network-online.target" ]; - requires = [ "matrix-ooye-pre-start.service" ]; + requires = [ + "network-online.target" + "matrix-ooye-pre-start.service" + ]; wantedBy = [ "multi-user.target" ]; startLimitIntervalSec = 5; -- 2.54.0