From 1a14b1d4d34a5539fbe568899845a0b9c29c6fa6 Mon Sep 17 00:00:00 2001
From: beatzaplenty <wayne.bennett@live.com>
Date: Sat, 25 Jul 2026 19:50:35 +1000
Subject: [PATCH] fix(lxc): move sops-reinstall service from sysinit to
 network.target

nixos-lxc-sops-reinstall.service called switch-to-configuration test at
sysinit.target time (DefaultDependencies=false), before D-Bus was up.
D-Bus is required to restart systemd targets after activation scripts
run. The service reported failure on every boot (exit 1: "Failed to open
dbus connection") even though secrets were correctly installed, because
the D-Bus call happens after activation scripts complete.

Move the service to network.target so basic.target (which includes
dbus-broker.service) runs first. Also drop DefaultDependencies=false so
systemd auto-adds After=basic.target. Add SuccessExitStatus=11 to handle
the edge case where switch-to-configuration holds the lock during a
concurrent rebuild (exit 11 = "Could not acquire lock" -- the rebuild's
own activation already installed the secrets, so treating it as success
is correct).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx
---
 modules/platforms/lxc.nix | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/modules/platforms/lxc.nix b/modules/platforms/lxc.nix
index 0188cef..d9c37a7 100644
--- a/modules/platforms/lxc.nix
+++ b/modules/platforms/lxc.nix
@@ -217,28 +217,32 @@ in
   # are permanently absent after the first boot and every service that
   # reads from /run/secrets fails on start.
   #
-  # wantedBy/before sysinit.target + DefaultDependencies=false mirrors how
-  # the sops-nix module places its own service when it generates one. This
-  # ensures secrets exist before basic.target (and thus before any user
-  # service) starts. DefaultDependencies=false is required to avoid a
-  # circular ordering: without it, systemd would add After=sysinit.target
-  # to a service that is itself part of sysinit.target.
+  # wantedBy/before network.target: switch-to-configuration test requires
+  # D-Bus to restart systemd targets after running activation scripts. D-Bus
+  # is available once basic.target completes (the default After=basic.target
+  # that DefaultDependencies would otherwise add). Placing the service before
+  # network.target ensures secrets are ready before any network-dependent
+  # service (including beszel-agent and nix-serve) starts, while running late
+  # enough that D-Bus is already up.
   #
   # ConditionPathExists=... skips this service on the genuine first boot
   # (the marker doesn't exist yet); nixos-lxc-first-boot-activate handles
   # that case. On every subsequent boot the condition passes and secrets
   # are reinstalled before user services start.
+  #
+  # SuccessExitStatus=11: switch-to-configuration exits 11 when it cannot
+  # acquire the activation lock (another switch is already in progress).
+  # During a nixos-rebuild switch the activation already installs secrets, so
+  # treating the lock-held case as success is correct.
   systemd.services.nixos-lxc-sops-reinstall = {
     description = "Reinstall sops secrets on each non-first boot (LXC, /run is tmpfs)";
-    wantedBy = [ "sysinit.target" ];
-    before = [ "sysinit.target" ];
-    unitConfig = {
-      DefaultDependencies = false;
-      ConditionPathExists = "/var/lib/nixos-lxc-first-boot-activated";
-    };
+    wantedBy = [ "network.target" ];
+    before = [ "network.target" ];
+    unitConfig.ConditionPathExists = "/var/lib/nixos-lxc-first-boot-activated";
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
+      SuccessExitStatus = "11";
     };
     script = ''
       /run/current-system/bin/switch-to-configuration test