From 5704e358e0b892da533a37116adaa899737159f4 Mon Sep 17 00:00:00 2001
From: Max <max@privatevoid.net>
Date: Thu, 22 Aug 2024 23:28:46 +0200
Subject: [PATCH] cluster/services/consul: laod system management token on
 startup WIP

---
 cluster/services/consul/agent.nix | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/cluster/services/consul/agent.nix b/cluster/services/consul/agent.nix
index bb15651..8cdbcf6 100644
--- a/cluster/services/consul/agent.nix
+++ b/cluster/services/consul/agent.nix
@@ -35,7 +35,30 @@ in
     };
   };
 
-  systemd.services.consul.serviceConfig.Type = "notify";
+  systemd.services = {
+    consul.serviceConfig.Type = "notify";
+    consul-load-smt = {
+      wantedBy = [ "consul.service" ];
+      after = [ "consul.service" ];
+      environment.CONSUL_HTTP_ADDR = config.links.consulAgent.tuple;
+      path = [
+        config.services.consul.package
+      ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+      script = ''
+        while ! test -e /run/locksmith/consul-systemManagementToken; do
+          echo Waiting for System Management Token
+          systemctl start locksmith.service
+          sleep 5
+        done
+        export CONSUL_HTTP_TOKEN_FILE=/run/locksmith/consul-systemManagementToken
+        consul acl set-agent-token default "$(< /run/locksmith/consul-systemManagementToken)" # TODO: don't leak token on cmdline
+      '';
+    };
+  };
 
   services.grafana-agent.settings.integrations.consul_exporter = {
     enabled = true;