randogoth/bucur
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix jirorian service startup: use ExecStart wrapper for secrets

Browse source 
systemd loads EnvironmentFile before ExecStartPre runs, so the env file
could never exist in time. Replace with a single ExecStart wrapper script
that reads sops secrets directly and execs jirorian.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
randogoth 2026-06-08 10:25:45 +03:00
parent 3a88992c96
commit 288ce840ad
1 changed files with 11 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

24
modules/services/jirorian.nix
View file

@ -11,17 +11,17 @@ let
pkg = inputs.jirorian.packages.${pkgs.system}.default;
# Writes an EnvironmentFile from sops-managed secret files at service start.
makeEnv = pkgs.writeShellScript "jirorian-make-env" ''
# Wrapper that exports secrets from sops-managed files then execs jirorian.
# EnvironmentFile cannot be used here because systemd loads it before
# ExecStartPre runs, so we read secrets inline in ExecStart instead.
startScript = pkgs.writeShellScript "jirorian-start" ''
set -euo pipefail
install -m 0600 /dev/null /run/jirorian/env
{
echo "R2_ACCESS_KEY_ID=$(cat ${config.sops.secrets.jirorian_r2_access_key_id.path})"
echo "R2_SECRET_ACCESS_KEY=$(cat ${config.sops.secrets.jirorian_r2_secret_access_key.path})"
echo "R2_ENDPOINT=$(cat ${config.sops.secrets.jirorian_r2_endpoint.path})"
echo "SERVICE_NOSTR_PRIVKEY=$(cat ${config.sops.secrets.jirorian_nostr_privkey.path})"
echo "JIRORIAN_APP_SECRETS=$(cat ${config.sops.secrets.jirorian_app_secrets.path})"
} >> /run/jirorian/env
export R2_ACCESS_KEY_ID=$(cat ${config.sops.secrets.jirorian_r2_access_key_id.path})
export R2_SECRET_ACCESS_KEY=$(cat ${config.sops.secrets.jirorian_r2_secret_access_key.path})
export R2_ENDPOINT=$(cat ${config.sops.secrets.jirorian_r2_endpoint.path})
export SERVICE_NOSTR_PRIVKEY=$(cat ${config.sops.secrets.jirorian_nostr_privkey.path})
export JIRORIAN_APP_SECRETS=$(cat ${config.sops.secrets.jirorian_app_secrets.path})
exec ${pkg}/bin/jirorian
'';
in
{
@ -49,9 +49,7 @@ in
Group = "jirorian";
StateDirectory = "jirorian";
RuntimeDirectory = "jirorian";
ExecStartPre = "+${makeEnv}";
ExecStart = "${pkg}/bin/jirorian";
EnvironmentFile = "/run/jirorian/env";
ExecStart = startScript;
Environment = [
"JIRORIAN_BASE_URL=https://${domain}"
"JIRORIAN_PORT=${toString port}"