From 2c0ee52d91598cc32eb75d1263d00f065c502847 Mon Sep 17 00:00:00 2001 From: Andreas Rammhold Date: Tue, 6 Oct 2020 22:52:55 +0200 Subject: [PATCH] nixos/security/acme: order after nss-lookup.target This should hopefully solve races with DNS servers (such as unbound) during the activation of a new generation. Previously unbound could still be unavailable and thus the acme script would fail. --- nixos/modules/security/acme.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix index 8e67d4ff871..2d33ca7e79e 100644 --- a/nixos/modules/security/acme.nix +++ b/nixos/modules/security/acme.nix @@ -207,7 +207,7 @@ let renewService = { description = "Renew ACME certificate for ${cert}"; - after = [ "network.target" "network-online.target" "acme-fixperms.service" ] ++ selfsignedDeps; + after = [ "network.target" "network-online.target" "acme-fixperms.service" "nss-lookup.target" ] ++ selfsignedDeps; wants = [ "network-online.target" "acme-fixperms.service" ] ++ selfsignedDeps; # https://github.com/NixOS/nixpkgs/pull/81371#issuecomment-605526099