From 92f79622f9bfd2cfc0e30702dd74d95b16cfce33 Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 4 Nov 2026 17:17:56 +0100 Subject: [PATCH] give the secrets unit a private tmp for its prefetched secrets --- nix/host-modules/swarm-authelia.nix | 4 ++++ nix/module-eval/secret-publisher.nix | 2 ++ 2 files changed, 6 insertions(+) diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix index 14523aa4..35fe0316 100644 --- a/nix/host-modules/swarm-authelia.nix +++ b/nix/host-modules/swarm-authelia.nix @@ -1215,6 +1215,10 @@ in storeRetry.serviceConfig // { LoadCredential = lib.attrNames storeFiles; + # `store_prefetch` keeps secret values in files under the + # temporary directory. A private one is removed by systemd when + # the unit stops, which a kill at the start timeout is too. + PrivateTmp = true; # Bounds one run, and so the container's boot when the store # accepts a connection and never answers: this unit is in the # boot wait of a container with a one-minute start limit. diff --git a/nix/module-eval/secret-publisher.nix b/nix/module-eval/secret-publisher.nix index d0c1d720..863b942e 100644 --- a/nix/module-eval/secret-publisher.nix +++ b/nix/module-eval/secret-publisher.nix @@ -558,6 +558,8 @@ let phases = lib.filter (lib.hasPrefix "phase_done ") lines; in (unit secretPublisherHere).serviceConfig.TimeoutStartSec == 30 + && (unit secretPublisherHere).serviceConfig.PrivateTmp or false + && !((unit secretPublisherNoIdentity).serviceConfig ? PrivateTmp) && lib.length calls == 1 && lib.length clientLeaves >= 4 && lib.all hasLeaf clientLeaves