cleanup secrets into different files and optional set user password etc

1 files changed, 13 insertions, 0 deletions

diff --git a/modules/root/wifi.nix b/modules/root/wifi.nix
index 542cfd7..96fe5c8 100644
--- a/modules/root/wifi.nix
+++ b/modules/root/wifi.nix
@@ -14,5 +14,18 @@
 		environment.etc."wpa_supplicant.conf" = {
 			source = config.sops.secrets.wpa_supplicant-conf.path;
 		};
+
+		# This service is a workaround to ensure that secrets are available on
+		# reboot when the secret keys are on a separate subvolume
+		systemd.services.npcnix-force-rebuild-sops-hack = {
+			wantedBy = [ "multi-user.target" ];
+			before = [ "wpa_supplicant.service" ];
+			serviceConfig = {
+				ExecStart = "/run/current-system/activate";
+				Type = "oneshot";
+				Restart = "on-failure"; # because oneshot
+				RestartSec = "10s";
+			};
+		};
 	};
 }