web-arm: onecli-db-password oneshot cannot read its sops secret #340

New issue

Closed

opened 2026-08-14 19:37:25 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-08-14 19:37:25 +02:00

Owner

First activation of the merged #339 on web-arm failed:

onecli-db-password-start: cat: /run/secrets/onecli-db-password: Permission denied
podman-onecli.service: Job failed with result 'dependency'.

The oneshot runs as User=postgres, but sops-nix installs the secret root-owned 0400. Fix: hand the secret over via systemd LoadCredential (the keycloak module's pattern) instead of reading the sops path directly.

While in there, also order the oneshot after postgresql-setup.service explicitly: ordering on postgresql.target protects a cold boot, but on a live switch the target is already active, so the oneshot can race the role creation that postgresql-setup performs (PR 339 review CONCERN 1's residual case).

First activation of the merged #339 on web-arm failed: onecli-db-password-start: cat: /run/secrets/onecli-db-password: Permission denied podman-onecli.service: Job failed with result 'dependency'. The oneshot runs as User=postgres, but sops-nix installs the secret root-owned 0400. Fix: hand the secret over via systemd LoadCredential (the keycloak module's pattern) instead of reading the sops path directly. While in there, also order the oneshot after postgresql-setup.service explicitly: ordering on postgresql.target protects a cold boot, but on a live switch the target is already active, so the oneshot can race the role creation that postgresql-setup performs (PR 339 review CONCERN 1's residual case).

dominik.polakovics referenced this issue from a commit

2026-08-14 19:37:59 +02:00

fix(web-arm): hand onecli-db-password to the oneshot via LoadCredential

dominik.polakovics referenced this issue from a pull request that will close it,

2026-08-14 19:39:09 +02:00

fix(web-arm): onecli-db-password oneshot — LoadCredential + setup ordering #341

dominik.polakovics closed this issue

2026-08-14 19:40:46 +02:00