cluster/services/chant/listener.nix

@@ -52,7 +52,7 @@ let
                 triggers.add(target)
 
         for trigger in triggers:
-            subprocess.run(["${config.systemd.package}/bin/systemctl", "start", f"{trigger}.service"])
+            subprocess.run(["${config.systemd.package}/bin/systemctl", "start", "--no-block", f"{trigger}.service"])
 
     with open(indexFile, "w") as f:
         f.write(newIndex)

cluster/services/locksmith/default.nix

@@ -1,10 +0,0 @@
-{ config, ... }:
-
-{
-  services.locksmith = {
-    nodes.receiver = config.services.consul.nodes.agent;
-    nixos.receiver = [
-      ./receiver.nix
-    ];
-  };
-}

cluster/services/locksmith/receiver.nix

@@ -1,53 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  consulCfg = config.services.consul.extraConfig;
-  consulIpAddr = consulCfg.addresses.http or "127.0.0.1";
-  consulHttpAddr = "${consulIpAddr}:${toString (consulCfg.ports.http or 8500)}";
-
-  kvRoot = "secrets/locksmith";
-  kvValue = "recipient/${config.networking.hostName}";
-in
-
-{
-  systemd.tmpfiles.settings.locksmith = {
-    "/run/locksmith".d = {
-      mode = "0711";
-    };
-  };
-
-  systemd.services.locksmith = {
-    description = "The Locksmith's Chant";
-    wantedBy = [ "multi-user.target" ];
-    wants = [ "consul.service" ];
-    after = [ "consul.service" ];
-    chant.enable = true;
-    path = [
-      config.services.consul.package
-    ];
-    environment = {
-      CONSUL_HTTP_ADDR = consulHttpAddr;
-    };
-    serviceConfig = {
-      PrivateTmp = true;
-      WorkingDirectory = "/tmp";
-      IPAddressDeny = [ "any" ];
-      IPAddressAllow = [ consulIpAddr ];
-      LoadCredential = lib.mkForce [];
-    };
-    script = ''
-      consul kv get --keys ${kvRoot}/ | ${pkgs.gnused}/bin/sed 's,/$,,g' | while read secret; do
-        out="$(mktemp -u /run/locksmith/.locksmith-secret.XXXXXXXXXXXXXXXX)"
-        if [[ "$(consul kv get --keys "$secret/${kvValue}")" == "$secret/${kvValue}" ]]; then
-          owner="$(consul kv get "$secret/owner")"
-          group="$(consul kv get "$secret/group")"
-          mode="$(consul kv get "$secret/mode")"
-          consul kv get "$secret/${kvValue}" | ${pkgs.age}/bin/age --decrypt -i /etc/ssh/ssh_host_ed25519_key -o $out
-          chown -v "$owner:$group" $out
-          chmod -v "$mode" $out
-          mv -v $out "/run/locksmith/$(basename "$secret")"
-        fi
-      done
-    '';
-  };
-}