modules/platforms/lxc.nix

@@ -217,28 +217,32 @@ in
   # are permanently absent after the first boot and every service that
   # reads from /run/secrets fails on start.
   #
-  # wantedBy/before sysinit.target + DefaultDependencies=false mirrors how
-  # the sops-nix module places its own service when it generates one. This
-  # ensures secrets exist before basic.target (and thus before any user
-  # service) starts. DefaultDependencies=false is required to avoid a
-  # circular ordering: without it, systemd would add After=sysinit.target
-  # to a service that is itself part of sysinit.target.
+  # wantedBy/before network.target: switch-to-configuration test requires
+  # D-Bus to restart systemd targets after running activation scripts. D-Bus
+  # is available once basic.target completes (the default After=basic.target
+  # that DefaultDependencies would otherwise add). Placing the service before
+  # network.target ensures secrets are ready before any network-dependent
+  # service (including beszel-agent and nix-serve) starts, while running late
+  # enough that D-Bus is already up.
   #
   # ConditionPathExists=... skips this service on the genuine first boot
   # (the marker doesn't exist yet); nixos-lxc-first-boot-activate handles
   # that case. On every subsequent boot the condition passes and secrets
   # are reinstalled before user services start.
+  #
+  # SuccessExitStatus=11: switch-to-configuration exits 11 when it cannot
+  # acquire the activation lock (another switch is already in progress).
+  # During a nixos-rebuild switch the activation already installs secrets, so
+  # treating the lock-held case as success is correct.
   systemd.services.nixos-lxc-sops-reinstall = {
     description = "Reinstall sops secrets on each non-first boot (LXC, /run is tmpfs)";
-    wantedBy = [ "sysinit.target" ];
-    before = [ "sysinit.target" ];
-    unitConfig = {
-      DefaultDependencies = false;
-      ConditionPathExists = "/var/lib/nixos-lxc-first-boot-activated";
-    };
+    wantedBy = [ "network.target" ];
+    before = [ "network.target" ];
+    unitConfig.ConditionPathExists = "/var/lib/nixos-lxc-first-boot-activated";
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
+      SuccessExitStatus = "11";
     };
     script = ''
       /run/current-system/bin/switch-to-configuration test