guixsd-config

commit 69cd4f977131d0dc3fc89009092af5185427ccdb
parent bb3b5407db3c579825a138d3649356340246bf73
Author: Vineet Kumar <git@vineetk.net>
Date:   Fri,  6 Feb 2026 18:28:20 -0500

demiurge: add wireguard-wg1 dependency on age-secret

Diffstat:
M
epistemia/services/age-secret.scm
 | 
13
++++++++++++-
M
epistemia/systems/demiurge.scm
 | 
1
+

2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/epistemia/services/age-secret.scm b/epistemia/services/age-secret.scm
@@ -2,6 +2,7 @@
   #:use-module (guix gexp)
   #:use-module (guix records)
   #:use-module (gnu services)
+  #:use-module (gnu services shepherd)
   #:use-module (gnu packages golang-crypto)
   #:use-module (ice-9 match)
   #:export (age-secret-service-type
@@ -75,12 +76,22 @@
                              (age-secret-mode s)))
                      secrets)))))))
 
+(define (age-secret-shepherd-service config)
+  (list (shepherd-service
+         (provision '(age-secret))
+         (requirement '())
+         (one-shot? #t)
+         (start #~(lambda () #t))
+         (documentation "Age secret decryption marker service."))))
+
 (define age-secret-service-type
   (service-type
     (name 'age-secret)
     (extensions
      (list (service-extension activation-service-type
-                              age-secret-activation)))
+                              age-secret-activation)
+           (service-extension shepherd-root-service-type
+                              age-secret-shepherd-service)))
     (description
      "Decrypts age-encrypted files at boot using host keys and assigns ownership.")
     (default-value (age-secret-configuration))))
diff --git a/epistemia/systems/demiurge.scm b/epistemia/systems/demiurge.scm
@@ -244,6 +244,7 @@ rpz:
 						      (bootstrap-private-key? #f)
 						      (private-key "/run/secrets/wg1_demiurge")
 						      (table #f)
+						      (shepherd-requirement '(age-secret))
 						      (post-up
 						       ;; IPv4 and IPv6 NAT
 						       (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE")