flake.lock: Update

Flake lock file updates:

• Updated input 'agenix':
    'github:ryantm/agenix/3f1dae074a12feb7327b4bf43cbac0d124488bb7?narHash=sha256-ZeS51uJI30ehNkcZ4uKqT4ZDARPyqrHADSKAwv5vVCU%3D' (2024-07-30)
  → 'github:ryantm/agenix/f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41?narHash=sha256-b%2Buqzj%2BWa6xgMS9aNbX4I%2BsXeb5biPDi39VgvSFqFvU%3D' (2024-08-10)
• Updated input 'attic':
    'github:zhaofengli/attic/e127acbf9a71ebc0c26bc8e28346822e0a6e16ba?narHash=sha256-GJIz4M5HDB948Ex/8cPvbkrNzl/eKUE7/c21JBu4lb8%3D' (2024-08-01)
  → 'github:zhaofengli/attic/6d9aeaef0a067d664cb11bb7704f7ec373d47fb2?narHash=sha256-cltFh4su2vcFidxKp7LuEgX3ZGLfPy0DCdrQZ/QTe68%3D' (2024-08-21)
• Updated input 'attic/crane':
    'github:ipetkov/crane/480dff0be03dac0e51a8dfc26e882b0d123a450e?narHash=sha256-dIubLa56W9sNNz0e8jGxrX3CAkPXsq7snuFA/Ie6dn8%3D' (2024-05-29)
  → 'github:ipetkov/crane/4c6c77920b8d44cd6660c1621dea6b3fc4b4c4f4?narHash=sha256-NhCkJJQhD5GUib8zN9JrmYGMwt4lCRp6ZVNzIiYCl0Y%3D' (2024-08-06)
• Updated input 'hercules-ci-agent':
    'github:hercules-ci/hercules-ci-agent/2e10fb21fc2e07edf40763b73443e5934bd40947?narHash=sha256-QDbU8LZzcUSqBp1CBqDj/f5Wd/sdgQ8pZwRWueoMUL4%3D' (2024-07-05)
  → 'github:hercules-ci/hercules-ci-agent/c303cc8e437c0fd26b9452472e7df5aa374e9177?narHash=sha256-/Vdg5ZKtP71ZEKVV6JXlrOEu0CM2Flcs%2BnwDmWRzgjQ%3D' (2024-08-15)
• Updated input 'nar-serve':
    'github:numtide/nar-serve/9d0eff868d328fe67c60c26c8ba50e0b9d8de867?narHash=sha256-8QuMS00EutmqzAIPxyJEPxM8EHiWlSKs6E2Htoh3Kes%3D' (2024-07-31)
  → 'github:numtide/nar-serve/846cb9d55aee9af7c7a1eaf7016f2c5b9e01cc6e?narHash=sha256-i%2B9i1D5zEz2c3o5RuH%2BX/jDRmA12vgU8UxxE0/TPvtE%3D' (2024-08-15)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/f2d6c7123138044e0c68902268bd8f37dd7e2fa7?narHash=sha256-g4L%2BI8rDl7RQy5x8XcEMqNO49LFhrHTzVBqXtG2%2BFGo%3D' (2024-08-01)
  → 'github:NixOS/nixpkgs/ac2df85f4d5c580786c7b4db031c199554152681?narHash=sha256-zf3gNf0nX2yOb%2B%2Bh4jW9l4iG8R/LfazWZD%2BKhmW6fcc%3D' (2024-08-21)

cluster/lib/mesh.nix

@@ -3,14 +3,12 @@
 {
   hostLinks = lib.pipe config.services [
     (lib.filterAttrs (_: svc: svc.meshLinks != {}))
-    (lib.mapAttrsToList (svcName: svc:
+    (lib.mapAttrsToList (svcName: svc: lib.mapAttrsToList (name: cfg: lib.genAttrs svc.nodes.${name} (hostName: {
-      lib.mapAttrsToList (groupName: links:
+      ${cfg.name} = { ... }: {
-        lib.genAttrs svc.nodes.${groupName} (hostName: lib.mapAttrs (_: cfg: { ... }: {
+        imports = [ cfg.link ];
-          imports = [ cfg.link ];
+        ipv4 = config.vars.mesh.${hostName}.meshIp;
-          ipv4 = config.vars.mesh.${hostName}.meshIp;
+      };
-        }) links)
+    })) svc.meshLinks))
-      ) svc.meshLinks
-    ))
     (map lib.mkMerge)
     lib.mkMerge
   ];

cluster/lib/service-module.nix

@@ -38,8 +38,12 @@ in
     };
     meshLinks = mkOption {
       description = "Create host links on the mesh network.";
-      type = types.attrsOf (types.attrsOf (types.submodule {
+      type = types.attrsOf (types.submodule ({ name, ... }: {
         options = {
+          name = mkOption {
+            type = types.str;
+            default = "${serviceName}-${name}";
+          };
           link = mkOption {
             type = types.deferredModule;
             default = {};

cluster/services/acme-client/client.nix

@@ -74,7 +74,7 @@ in
       serviceConfig = {
         Restart = "on-failure";
         RestartMaxDelaySec = 30;
-        RestartSteps = 5;
+        RestartStesp = 5;
         RestartMode = "direct";
       };
     };

cluster/services/attic/default.nix

@@ -16,7 +16,10 @@
         ./nar-serve.nix
       ];
     };
-    meshLinks.server.attic.link.protocol = "http";
+    meshLinks.server = {
+      name = "attic";
+      link.protocol = "http";
+    };
     secrets = let
       inherit (config.services.attic) nodes;
     in {

cluster/services/attic/server.nix

@@ -80,7 +80,6 @@ in
     mode = if isMonolith then "manual" else "direct";
     definition = {
       name = "atticd";
-      id = "atticd-${config.services.atticd.mode}";
       address = link.ipv4;
       inherit (link) port;
       checks = [

cluster/services/forge/default.nix

@@ -4,7 +4,10 @@
   services.forge = {
     nodes.server = [ "VEGAS" ];
     nixos.server = ./server.nix;
-    meshLinks.server.forge.link.protocol = "http";
+    meshLinks.server = {
+      name = "forge";
+      link.protocol = "http";
+    };
     secrets = with config.services.forge.nodes; {
       oidcSecret = {
         nodes = server;

cluster/services/idm/server.nix

@@ -33,9 +33,6 @@ in
       ldapbindaddress = "${ldapLink.ipv4}:${ldapLink.portStr}";
       origin = frontendLink.url;
       inherit domain;
-      online_backup = {
-        versions = 7;
-      };
     };
   };
 

cluster/services/ipfs/default.nix

@@ -29,7 +29,10 @@
       io-tweaks = [ "VEGAS" ];
       remote-api = [ "VEGAS" ];
     };
-    meshLinks.gateway.ipfsGateway.link.protocol = "http";
+    meshLinks.gateway = {
+      name = "ipfsGateway";
+      link.protocol = "http";
+    };
     nixos = {
       node = [
         ./node.nix

cluster/services/ipfs/monitoring.nix

@@ -9,7 +9,7 @@ in
     environment = {
       OTEL_TRACES_EXPORTER = "otlp";
       OTEL_EXPORTER_OTLP_PROTOCOL = "grpc";
-      OTEL_EXPORTER_OTLP_ENDPOINT = "${cluster.config.ways.ingest-traces-otlp.url}:443";
+      OTEL_EXPORTER_OTLP_ENDPOINT = cluster.config.links.tempo-otlp-grpc.url;
       OTEL_TRACES_SAMPLER = "parentbased_traceidratio";
       OTEL_TRACES_SAMPLER_ARG = "0.50";
     };

cluster/services/monitoring/client.nix

@@ -26,7 +26,7 @@ in {
         name = "logging";
         positions.filename = "\${STATE_DIRECTORY:/tmp}/logging-positions.yaml";
         clients = singleton {
-          url = "${cluster.config.ways.ingest-logs.url}/loki/api/v1/push";
+          url = "${cluster.config.ways.monitoring-logs.url}/loki/api/v1/push";
         };
         scrape_configs = singleton {
           job_name = "journal";

cluster/services/monitoring/default.nix

@@ -18,6 +18,26 @@ in
       protocol = "http";
       ipv4 = meshIpFor "server";
     };
+    tempo = {
+      protocol = "http";
+      ipv4 = meshIpFor "server";
+    };
+    tempo-grpc = {
+      protocol = "http";
+      ipv4 = "127.0.0.1";
+    };
+    tempo-otlp-http = {
+      protocol = "http";
+      ipv4 = meshIpFor "server";
+    };
+    tempo-otlp-grpc = {
+      protocol = "http";
+      ipv4 = meshIpFor "server";
+    };
+    tempo-zipkin-http = {
+      protocol = "http";
+      ipv4 = meshIpFor "server";
+    };
   };
   hostLinks = lib.genAttrs config.services.monitoring.nodes.grafana (name: {
     grafana = {
@@ -31,7 +51,6 @@ in
       blackbox = [ "checkmate" "grail" "prophet" ];
       grafana = [ "VEGAS" "prophet" ];
       logging = [ "VEGAS" "grail" ];
-      tracing = [ "VEGAS" "grail" ];
       server = [ "VEGAS" ];
     };
     nixos = {
@@ -42,19 +61,14 @@ in
         ./provisioning/dashboards.nix
       ];
       logging = ./logging.nix;
-      tracing = ./tracing.nix;
       server = [
         ./server.nix
+        ./tracing.nix
       ];
     };
-    meshLinks = {
+    meshLinks.logging = {
-      logging.loki.link.protocol = "http";
+      name = "loki";
-      tracing = {
+      link.protocol = "http";
-        tempo.link.protocol = "http";
-        tempo-otlp-http.link.protocol = "http";
-        tempo-otlp-grpc.link.protocol = "grpc";
-        tempo-zipkin-http.link.protocol = "http";
-      };
     };
   };
 
@@ -68,51 +82,29 @@ in
         nodes = config.services.monitoring.nodes.logging;
         format = "envFile";
       };
-      tempo-ingest.locksmith = {
+      tempo = { };
-        nodes = config.services.monitoring.nodes.tracing;
-        format = "envFile";
-      };
-      tempo-query.locksmith = {
-        nodes = config.services.monitoring.nodes.tracing;
-        format = "envFile";
-      };
     };
     buckets = {
       loki-chunks.allow = {
         loki-ingest = [ "read" "write" ];
         loki-query = [ "read" ];
       };
-      tempo-chunks.allow = {
+      tempo-chunks.allow.tempo = [ "read" "write" ];
-        tempo-ingest = [ "read" "write" ];
-        tempo-query = [ "read" ];
-      };
     };
   };
 
-  ways = let
+  ways = config.lib.forService "monitoring" {
-    query = consulService: {
+    monitoring = {
-      inherit consulService;
+      consulService = "grafana";
-      internal = true;
+      extras.locations."/".proxyWebsockets = true;
-      extras.extraConfig = ''
-        proxy_read_timeout 3600s;
-      '';
     };
-    ingest = consulService: {
+    monitoring-logs = {
-      inherit consulService;
       internal = true;
+      consulService = "loki";
       extras.extraConfig = ''
         client_max_body_size 4G;
         proxy_read_timeout 3600s;
       '';
     };
-  in config.lib.forService "monitoring" {
-    monitoring = {
-      consulService = "grafana";
-      extras.locations."/".proxyWebsockets = true;
-    };
-    monitoring-logs = query "loki";
-    monitoring-traces = query "tempo";
-    ingest-logs = ingest "loki";
-    ingest-traces-otlp = ingest "tempo-ingest-otlp-grpc" // { grpc = true; };
   };
 }

cluster/services/monitoring/grafana-ha.nix

@@ -73,16 +73,6 @@ in
           inherit (cluster.config.ways.monitoring-logs) url;
           type = "loki";
         }
-        {
-          name = "Tempo";
-          uid = "P214B5B846CF3925F";
-          inherit (cluster.config.ways.monitoring-traces) url;
-          type = "tempo";
-          jsonData = {
-            serviceMap.datasourceUid = "PBFA97CFB590B2093";
-            nodeGraph.enabled = true;
-          };
-        }
       ];
     };
   };

cluster/services/monitoring/secrets/tempo-secrets.age

@@ -0,0 +1,16 @@
+age-encryption.org/v1
+-> ssh-ed25519 NO562A KhCGp7PAMGrEdzRxBrsW4tRk30JwpI+4lPzrRCUhSw4
+8s7WqA5c3zS1euN5R+jfFNBdvr8OQW8P4NFeqtNsIKo
+-> ssh-ed25519 5/zT0w 79hJQ2H76EZTW7YcQFCtKaS5Kbssx4Z8dPFjIVzRgFk
+A1fDJbUnyIRy+kWa3PhJNj/SdRPlcEy6FYsAfnuZ2AQ
+-> ssh-ed25519 d3WGuA aylkdL1KliM1NfrYDGlG8X6YjXvVUCU4sV90I+a840U
+6sXdqIPjtoNSylZRh1DCghHOwDo+fC7WB4QWQoWmG48
+-> //gd+2-grease baUWA$3 z-qs3W O/2.1W
+Sfq3+rkMJhpUTTmcos5TaaUtX2Ip9pciHAZLiWPix+C9N7ccac/1W5RNedMJCLsq
+MQ+xKzexf8+hgNVhKOksvbKBBROXqk1bUOKk8w3OgFPmmByzmCBUwkdkeu5DFTYR
+rg
+--- kUl1uIPRkM5y7C68kdN22pMKXP7gazyha4PE+ap0Jqw
+w>×Àè¥
+<15>CÈ,\‰ßœI¯ˆúHxG@^Çá“PåÃþÙÏlw6
µŽ{þ’rb‘é5æ†T>Êñ
+ÚWܤX4Kp(ß?9ˆß­^^oP3f </v3N$ê¤sÓbŽ¾>O™÷œ+òN0άïµàDtêŽ5Vº#è ¶³‘Uã îŸ#y|›@ŒGzSi»­ô*·HùüŽ]
+ꎀ5›

cluster/services/monitoring/tracing.nix

@@ -1,16 +1,14 @@
 { cluster, config, pkgs, ... }:
 
 let
-  inherit (cluster.config.links) prometheus-ingest;
+  inherit (cluster.config) links;
-  inherit (config.links) tempo-grpc;
-  links = cluster.config.hostLinks.${config.networking.hostName};
   dataDir = "/srv/storage/private/tempo";
   tempoConfig = {
     server = {
       http_listen_address = links.tempo.ipv4;
       http_listen_port = links.tempo.port;
-      grpc_listen_address = tempo-grpc.ipv4;
+      grpc_listen_address = links.tempo-grpc.ipv4;
-      grpc_listen_port = tempo-grpc.port;
+      grpc_listen_port = links.tempo-grpc.port;
     };
     distributor.receivers = {
       otlp = {
@@ -21,7 +19,7 @@ let
       };
       zipkin.endpoint = links.tempo-zipkin-http.tuple;
     };
-    querier.frontend_worker.frontend_address = tempo-grpc.tuple;
+    querier.frontend_worker.frontend_address = links.tempo-grpc.tuple;
     ingester = {
       trace_idle_period = "30s";
       max_block_bytes = 1000000;
@@ -58,7 +56,7 @@ let
         path = "${dataDir}/generator/wal";
         remote_write = [
           {
-            url = "${prometheus-ingest.url}/api/v1/write";
+            url = "${links.prometheus-ingest.url}/api/v1/write";
             send_exemplars = true;
           }
         ];
@@ -70,11 +68,7 @@ let
     ];
   };
 in {
-  links.tempo-grpc.protocol = "http";
+  age.secrets.tempoSecrets.file = ./secrets/tempo-secrets.age;
-
-  services.locksmith.waitForSecrets.tempo = [
-    "garage-tempo-ingest"
-  ];
 
   users.users.tempo = {
     isSystemUser = true;
@@ -87,53 +81,24 @@ in {
 
   systemd.services.tempo = {
     wantedBy = [ "multi-user.target" ];
-    distributed = {
-      enable = true;
-      registerServices = [
-        "tempo"
-        "tempo-ingest-otlp-grpc"
-      ];
-    };
     serviceConfig = {
       User = "tempo";
       Group = "tempo";
       ExecStart = "${pkgs.tempo}/bin/tempo -config.file=${pkgs.writeText "tempo.yaml" (builtins.toJSON tempoConfig)}";
       PrivateTmp = true;
-      EnvironmentFile = "/run/locksmith/garage-tempo-ingest";
+      EnvironmentFile = config.age.secrets.tempoSecrets.path;
     };
   };
-
+  services.grafana.provision.datasources.settings.datasources = [
-  consul.services = {
+    {
-    tempo = {
+      name = "Tempo";
-      mode = "manual";
+      uid = "P214B5B846CF3925F";
-      definition = {
+      inherit (links.tempo) url;
-        name = "tempo";
+      type = "tempo";
-        address = links.tempo.ipv4;
+      jsonData = {
-        inherit (links.tempo) port;
+        serviceMap.datasourceUid = "PBFA97CFB590B2093"; # prometheus
-        checks = [
+        nodeGraph.enabled = true;
-          {
-            name = "Tempo";
-            id = "service:tempo:backend";
-            interval = "5s";
-            http = "${links.tempo.url}/ready";
-          }
-        ];
       };
-    };
+    }
-    tempo-ingest-otlp-grpc = {
+  ];
-      mode = "manual";
-      definition = {
-        name = "tempo-ingest-otlp-grpc";
-        address = links.tempo-otlp-grpc.ipv4;
-        inherit (links.tempo-otlp-grpc) port;
-        checks = [
-          {
-            name = "Tempo Service Status";
-            id = "service:tempo-ingest-otlp-grpc:tempo";
-            alias_service = "tempo";
-          }
-        ];
-      };
-    };
-  };
 }

cluster/services/sso/default.nix

@@ -1,4 +1,4 @@
-{ config, depot, ... }:
+{ depot, ... }:
 
 {
   services.sso = {
@@ -18,12 +18,4 @@
     login.target = ssoAddr;
     account.target = ssoAddr;
   };
-
-  patroni = config.lib.forService "sso" {
-    databases.keycloak = {};
-    users.keycloak.locksmith = {
-      nodes = config.services.sso.nodes.host;
-      format = "raw";
-    };
-  };
 }

cluster/services/sso/host.nix

@@ -8,10 +8,12 @@ in
 {
   links.keycloak.protocol = "http";
 
-  services.locksmith.waitForSecrets.keycloak = [
+  age.secrets.keycloak-dbpass = {
-    "patroni-keycloak"
+    file = ../../../secrets/keycloak-dbpass.age;
-  ];
+    owner = "root";
-
+    group = "root";
+    mode = "0400";
+  };
   services.nginx.virtualHosts = { 
     "${login}" = lib.recursiveUpdate (vhosts.proxy kc.url) {
       locations = {
@@ -34,7 +36,7 @@ in
       host = patroni.ipv4;
       inherit (patroni) port;
       useSSL = false;
-      passwordFile = "/run/locksmith/patroni-keycloak";
+      passwordFile = config.age.secrets.keycloak-dbpass.path;
     };
     settings = {
       http-host = kc.ipv4;
@@ -52,7 +54,7 @@ in
       "-Dotel.traces.exporter=otlp"
     ];
     OTEL_EXPORTER_OTLP_PROTOCOL = "grpc";
-    OTEL_EXPORTER_OTLP_ENDPOINT = cluster.config.ways.ingest-traces-otlp.url;
+    OTEL_EXPORTER_OTLP_ENDPOINT = cluster.config.links.tempo-otlp-grpc.url;
     OTEL_TRACES_SAMPLER = "parentbased_traceidratio";
     OTEL_TRACES_SAMPLER_ARG = "0.50";
   };

cluster/services/storage/garage-gateway.nix

@@ -36,9 +36,10 @@ in
         inherit (linkWeb) port;
         checks = [
           {
-            name = "Garage Service Status";
+            name = "Garage Node";
-            id = "service:garage-web:garage";
+            id = "service:garage-web:node";
-            alias_service = "garage";
+            interval = "5s";
+            http = "${config.links.garageMetrics.url}/health";
           }
         ];
       };

cluster/services/ways/host.nix

@@ -25,14 +25,7 @@ in
             ];
             locations = lib.mkMerge [
               {
-                "/" = if cfg.grpc then {
+                "/".proxyPass = cfg.target;
-                  extraConfig = ''
-                    set $nix_proxy_grpc_target ${cfg.target};
-                    grpc_pass $nix_proxy_grpc_target;
-                  '';
-                } else {
-                  proxyPass = cfg.target;
-                };
                 "${cfg.healthCheckPath}".extraConfig = "access_log off;";
               }
               {

cluster/services/ways/options/way.nix

@@ -35,12 +35,6 @@ with lib;
       };
     };
 
-    grpc = mkOption {
-      description = "Whether this endpoint is a gRPC service.";
-      type = types.bool;
-      default = false;
-    };
-
     target = mkOption {
       type = types.str;
     };
@@ -107,7 +101,7 @@ with lib;
     (lib.mkIf options.consulService.isDefined {
       useConsul = true;
       nginxUpstreamName = "ways_upstream_${builtins.hashString "md5" options.consulService.value}";
-      target = "${if config.grpc then "grpc" else "http"}://${options.nginxUpstreamName.value}";
+      target = "http://${options.nginxUpstreamName.value}";
     })
     (lib.mkIf options.bucket.isDefined {
       consulService = "garage-web";

flake.lock

@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1722339003,
+        "lastModified": 1723293904,
-        "narHash": "sha256-ZeS51uJI30ehNkcZ4uKqT4ZDARPyqrHADSKAwv5vVCU=",
+        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "3f1dae074a12feb7327b4bf43cbac0d124488bb7",
+        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
         "type": "github"
       },
       "original": {
@@ -40,11 +40,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722472866,
+        "lastModified": 1724226964,
-        "narHash": "sha256-GJIz4M5HDB948Ex/8cPvbkrNzl/eKUE7/c21JBu4lb8=",
+        "narHash": "sha256-cltFh4su2vcFidxKp7LuEgX3ZGLfPy0DCdrQZ/QTe68=",
         "owner": "zhaofengli",
         "repo": "attic",
-        "rev": "e127acbf9a71ebc0c26bc8e28346822e0a6e16ba",
+        "rev": "6d9aeaef0a067d664cb11bb7704f7ec373d47fb2",
         "type": "github"
       },
       "original": {
@@ -76,11 +76,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1717025063,
+        "lastModified": 1722960479,
-        "narHash": "sha256-dIubLa56W9sNNz0e8jGxrX3CAkPXsq7snuFA/Ie6dn8=",
+        "narHash": "sha256-NhCkJJQhD5GUib8zN9JrmYGMwt4lCRp6ZVNzIiYCl0Y=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "480dff0be03dac0e51a8dfc26e882b0d123a450e",
+        "rev": "4c6c77920b8d44cd6660c1621dea6b3fc4b4c4f4",
         "type": "github"
       },
       "original": {
@@ -268,11 +268,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1720223941,
+        "lastModified": 1723736589,
-        "narHash": "sha256-QDbU8LZzcUSqBp1CBqDj/f5Wd/sdgQ8pZwRWueoMUL4=",
+        "narHash": "sha256-/Vdg5ZKtP71ZEKVV6JXlrOEu0CM2Flcs+nwDmWRzgjQ=",
         "owner": "hercules-ci",
         "repo": "hercules-ci-agent",
-        "rev": "2e10fb21fc2e07edf40763b73443e5934bd40947",
+        "rev": "c303cc8e437c0fd26b9452472e7df5aa374e9177",
         "type": "github"
       },
       "original": {
@@ -399,11 +399,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1722409392,
+        "lastModified": 1723717449,
-        "narHash": "sha256-8QuMS00EutmqzAIPxyJEPxM8EHiWlSKs6E2Htoh3Kes=",
+        "narHash": "sha256-i+9i1D5zEz2c3o5RuH+X/jDRmA12vgU8UxxE0/TPvtE=",
         "owner": "numtide",
         "repo": "nar-serve",
-        "rev": "9d0eff868d328fe67c60c26c8ba50e0b9d8de867",
+        "rev": "846cb9d55aee9af7c7a1eaf7016f2c5b9e01cc6e",
         "type": "github"
       },
       "original": {
@@ -504,11 +504,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1722539632,
+        "lastModified": 1724221631,
-        "narHash": "sha256-g4L+I8rDl7RQy5x8XcEMqNO49LFhrHTzVBqXtG2+FGo=",
+        "narHash": "sha256-zf3gNf0nX2yOb++h4jW9l4iG8R/LfazWZD+KhmW6fcc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f2d6c7123138044e0c68902268bd8f37dd7e2fa7",
+        "rev": "ac2df85f4d5c580786c7b4db031c199554152681",
         "type": "github"
       },
       "original": {

modules/consul-distributed-services/default.nix

@@ -26,13 +26,11 @@ in
 
       cfg = v.distributed;
 
-      svcs = map (x: config.consul.services.${x}) cfg.registerServices;
+      svc = config.consul.services.${cfg.registerService};
 
       runWithRegistration = pkgs.writeShellScript "run-with-registration" ''
-        trap '${lib.concatStringsSep ";" (map (svc: svc.commands.deregister) svcs)}' EXIT
+        trap '${svc.commands.deregister}' EXIT
-        ${lib.concatStringsSep "\n" (
+        ${svc.commands.register}
-          map (svc: svc.commands.register) svcs
-        )}
         ''${@}
       '';
 
@@ -51,10 +49,10 @@ in
       [Service]
       ExecStartPre=${waitForConsul} 'services/${n}%i'
       ExecStart=
-      ExecStart=${consul}/bin/consul lock --name=${n} --n=${toString cfg.replicas} --shell=false --child-exit-code 'services/${n}%i' ${optionalString (cfg.registerServices != []) runWithRegistration} ${ExecStart}
+      ExecStart=${consul}/bin/consul lock --name=${n} --n=${toString cfg.replicas} --shell=false --child-exit-code 'services/${n}%i' ${optionalString (cfg.registerService != null) runWithRegistration} ${ExecStart}
       Environment="CONSUL_HTTP_ADDR=${consulHttpAddr}"
       ${optionalString (v.serviceConfig ? RestrictAddressFamilies) "RestrictAddressFamilies=AF_NETLINK"}
-      ${optionalString (cfg.registerServices != []) (lib.concatStringsSep "\n" (map (svc: "ExecStopPost=${svc.commands.deregister}") svcs))}
+      ${optionalString (cfg.registerService != null) "ExecStopPost=${svc.commands.deregister}"}
     ''))
   ];
 }

modules/systemd-extras/distributed.nix

@@ -17,11 +17,6 @@ with lib;
           type = with types; nullOr str;
           default = null;
         };
-        registerServices = mkOption {
-          description = "Consul services to register when this service gets started.";
-          type = with types; listOf str;
-          default = if config.distributed.registerService == null then [ ] else [ config.distributed.registerService ];
-        };
       };
     }));
   };