randogoth/bucur
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix jirorian service startup: use ExecStart wrapper for secrets

Browse source 
systemd loads EnvironmentFile before ExecStartPre runs, so the env file
could never exist in time. Replace with a single ExecStart wrapper script
that reads sops secrets directly and execs jirorian.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
randogoth 2026-06-08 10:25:45 +03:00
parent 3a88992c96
commit 288ce840ad
1 changed files with 11 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

24
modules/services/jirorian.nix
View file

@ -11,17 +11,17 @@ let
pkg = inputs.jirorian.packages.${pkgs.system}.default; pkg = inputs.jirorian.packages.${pkgs.system}.default;
# Writes an EnvironmentFile from sops-managed secret files at service start. # Wrapper that exports secrets from sops-managed files then execs jirorian.
makeEnv = pkgs.writeShellScript "jirorian-make-env" '' # EnvironmentFile cannot be used here because systemd loads it before
# ExecStartPre runs, so we read secrets inline in ExecStart instead.
startScript = pkgs.writeShellScript "jirorian-start" ''
set -euo pipefail set -euo pipefail
install -m 0600 /dev/null /run/jirorian/env export R2_ACCESS_KEY_ID=$(cat ${config.sops.secrets.jirorian_r2_access_key_id.path})
{ export R2_SECRET_ACCESS_KEY=$(cat ${config.sops.secrets.jirorian_r2_secret_access_key.path})
echo "R2_ACCESS_KEY_ID=$(cat ${config.sops.secrets.jirorian_r2_access_key_id.path})" export R2_ENDPOINT=$(cat ${config.sops.secrets.jirorian_r2_endpoint.path})
echo "R2_SECRET_ACCESS_KEY=$(cat ${config.sops.secrets.jirorian_r2_secret_access_key.path})" export SERVICE_NOSTR_PRIVKEY=$(cat ${config.sops.secrets.jirorian_nostr_privkey.path})
echo "R2_ENDPOINT=$(cat ${config.sops.secrets.jirorian_r2_endpoint.path})" export JIRORIAN_APP_SECRETS=$(cat ${config.sops.secrets.jirorian_app_secrets.path})
echo "SERVICE_NOSTR_PRIVKEY=$(cat ${config.sops.secrets.jirorian_nostr_privkey.path})" exec ${pkg}/bin/jirorian
echo "JIRORIAN_APP_SECRETS=$(cat ${config.sops.secrets.jirorian_app_secrets.path})"
} >> /run/jirorian/env
''; '';
in in
{ {
@ -49,9 +49,7 @@ in
Group = "jirorian"; Group = "jirorian";
StateDirectory = "jirorian"; StateDirectory = "jirorian";
RuntimeDirectory = "jirorian"; RuntimeDirectory = "jirorian";
ExecStartPre = "+${makeEnv}"; ExecStart = startScript;
ExecStart = "${pkg}/bin/jirorian";
EnvironmentFile = "/run/jirorian/env";
Environment = [ Environment = [
"JIRORIAN_BASE_URL=https://${domain}" "JIRORIAN_BASE_URL=https://${domain}"
"JIRORIAN_PORT=${toString port}" "JIRORIAN_PORT=${toString port}"