swarm-nats gateway cert reloads nginx without blocking the switch

nixos-rebuild switch no longer hangs when nginx is (re)started in the
same transaction: the cert unit is Before=nginx, so its synchronous
reload and nginx's queued start job waited on each other. The reload is
now queued with --no-block try-reload-or-restart, as the nixpkgs ACME
module does.

nix/host-modules/swarm-nats.nix

@@ -555,9 +555,10 @@ in
         chmod 0640 "$d/key.pem.new"
         mv -f "$d/key.pem.new" "$d/key.pem"
         mv -f "$d/cert.pem.new" "$d/cert.pem"
-        if systemctl is-active --quiet nginx.service; then
-          systemctl reload nginx.service
-        fi
+        # `--no-block`: this unit is `Before=nginx.service`, so a blocking
+        # reload waits on nginx's job queue while nginx's start job waits on
+        # this unit. `try-` is a no-op while nginx is not running.
+        systemctl --no-block try-reload-or-restart nginx.service
       '';
     };
 

nix/module-eval/nats-tls.nix

@@ -434,6 +434,9 @@ let
         && !(lib.elem "nginx.service" (copy.requiredBy or [ ]))
         && lib.hasInfix "throwaway self-signed" copy.script
         && lib.hasInfix "chgrp nginx" copy.script
+        && lib.hasInfix "systemctl --no-block try-reload-or-restart nginx.service" copy.script
+        && !(lib.hasInfix "systemctl reload" copy.script)
+        && !(lib.hasInfix "is-active" copy.script)
         && lib.hasInfix "systemctl start swarm-nats-gateway-cert.service" s.swarm-bao-nats-tls.script;
     }
   ];