hermes - 💡(How to fix) Fix [Feature]: Nix: Drop system.activationScripts

Problem or Use Case

/var/lib/hermes/.hermes/.env generation is semi-random in practice nixos-rebuild switch will not reliably re-write the env based on SOPS secrets.

My sops uses systemd activation instead of an activationScript. That's generally encouraged since activation scripts are kludgy. If I change the secrets, hermes will not get it's .env rebuild right away.

Proposed Solution

1. At least make sure the hermes-agent-setup sets deps to setupSecrets ensuring the secrets are there before hermes builds it's own. But that still won't work well out of the box on systems where useSystemdActivation is a different default. (see https://github.com/Mic92/sops-nix/blob/9ed65852b6257fbeae4355bc24ecfea307ca759a/modules/sops/default.nix#L321)

2. Move the whole activation script into the systemd unit as ExecStartPre. That's encouraged anyway and will always work.

Alternatives Considered

What's wrong with just setting the env in systemd? That's a well established pattern. Why generate this .env in the first place?

Why is the config merged? Why not just point to a static file in nix store? The nix-store version is merged with the /var/lib/hermes/.hermes/config.yaml. That will just leave weird effects when dropping options in the nix version. What's the benefit of keeping the old values? If the file needs to be writable for hermes, why not just overwrite it at startup? That's perhaps a bit more nix-style.

Feature Type

Other

Scope

Small (single file, < 50 lines)

Contribution

• I'd like to implement this myself and submit a PR

Debug Report (optional)